Mastodawn

With the unified SOC experience there might be some ANRs you want to exclude from XDR correlation. Now you can!

Either using the UI or add #DONT_CORR# at the beginning of the ANR description.

https://learn.microsoft.com/en-us/defender-xdr/exclude-analytics-rules-correlation

Exclude analytics rules from correlation in Microsoft Defender XDR - Microsoft Defender XDR

Learn how to exclude specific analytics rules from the correlation engine to maintain static incident grouping behavior similar to Microsoft Sentinel.