Automate incident updates and closures
Automate incident updates and closures based on the incident status. The Microsoft Defender integration has a bi-directional interface that enables incidents to create security incidents and to update the incidents after the security incident is created or closed.
Before you begin
Role required: sn_si.admin, sn_si.ingestion_profile_admin
Procedure
-
If you aren’t continuing from the previous section of the Scheduling process, access the profile you’re defining.
-
Navigate to All > Microsoft Defender Integration > Defender Incident Profiles.
-
Select the profile that you’re continuing to define.
-
Select Additional Options in the progress bar.
-
-
On the form, fill in the fields.
|
Category |
Field |
Description |
|---|---|---|
|
Incident Creation Updates |
Update Defender Incident status upon SIR Incident Creation |
Option to use the automated incident update functionality. The Defender incident status is updated with the comments after the SIR incident is created in the ServiceNow AI Platform. |
|
Initial incident status update |
Initial incident status that is updated in the Microsoft Defender environment. Options include: Active, In Progress, and Redirected. | |
|
Initial comments posted back to Incident |
Initial comments that are posted to the incident in the Defender environment. | |
|
Incident Closure Updates |
Close Defender Incident upon SIR Incident Closure |
Option to use the automated incident status update functionality. Incidents will be closed in Defender with the comments given after the SIR incident is closed in the ServiceNow AI Platform. |
|
Closure Incident Status Update |
Status update in Defender when the security incident is closed in SIR. | |
|
Closure Comments Posted back to incident |
Comments posted to the incident in Defender when the security incident is closed in SIR. | |
|
Incident classification |
Option to automatically update Microsoft Defender Incident Classification based on SIR Close Code. When a SIR is closed in ServiceNow, the selected SIR Close Code will automatically determine and update the Incident Classification field in the corresponding Microsoft Defender incident. Options include:
| |
|
Defender Pull Closed Incidents |
Pull Closed Incidents |
Option to fetch closed incidents during ongoing ingestion and one-time retrieval. Closed SIR incidents won’t be updated with new data from Defender. |
|
Defender Incident Comments and SIR Work notes synchronization |
Update SIR work notes with Defender incident comments |
Option to synchronize Security Incident work notes to Defender incident comments. Work notes added to the Security Incidents in ServiceNow appears with the prefix- Comment from Defender ID. |
|
Update Defender incident comments with SIR work notes |
Option to update your SIR work notes in the Defender incident comments. The comment in Microsoft Defender appears with the prefix- Comment from ServiceNow. |
-
Select Finish.
-
Activate the profile.
-
Select the Name section of the progress bar.
-
Select the Active check box.
-
Select Continue.
-
---
title: Automate incident updates and closures
description: Automate incident updates and closures based on the incident status. The Microsoft Defender integration has a bi-directional interface that enables incidents to create security incidents and to update the incidents after the security incident is created or closed.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/ms-defender-additional-op.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Microsoft Defender integration for Security Operations, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---
# Automate incident updates and closures
Automate incident updates and closures based on the incident status. The Microsoft Defender integration has a bi-directional interface that enables incidents to create security incidents and to update the incidents after the security incident is created or closed.
## Before you begin
Role required: sn\_si.admin, sn\_si.ingestion\_profile\_admin
## Procedure
1. If you aren’t continuing from the previous section of the Scheduling process, access the profile you’re defining.
1. Navigate to **All** > **Microsoft Defender Integration** > **Defender Incident Profiles**.
2. Select the profile that you’re continuing to define.
3. Select **Additional Options** in the progress bar.
2. On the form, fill in the fields.
<table id="table_kyc_qbg_p4b"><thead><tr><th>
Category
</th><th>
Field
</th><th>
Description
</th></tr></thead><tbody><tr><td rowspan="3">
Incident Creation Updates
</td><td>
Update Defender Incident status upon SIR Incident Creation
</td><td>
Option to use the automated incident update functionality. The Defender incident status is updated with the comments after the SIR incident is created in the ServiceNow AI Platform.
</td></tr><tr><td>
Initial incident status update
</td><td>
Initial incident status that is updated in the Microsoft Defender environment. Options include: Active, In Progress, and Redirected.
</td></tr><tr><td>
Initial comments posted back to Incident
</td><td>
Initial comments that are posted to the incident in the Defender environment.
</td></tr><tr><td rowspan="4">
Incident Closure Updates
</td><td>
Close Defender Incident upon SIR Incident Closure
</td><td>
Option to use the automated incident status update functionality. Incidents will be closed in Defender with the comments given after the SIR incident is closed in the ServiceNow AI Platform.
</td></tr><tr><td>
Closure Incident Status Update
</td><td>
Status update in Defender when the security incident is closed in SIR.
</td></tr><tr><td>
Closure Comments Posted back to incident
</td><td>
Comments posted to the incident in Defender when the security incident is closed in SIR.
</td></tr><tr><td>
Incident classification
</td><td>
Option to automatically update Microsoft Defender Incident Classification based on SIR Close Code.
When a SIR is closed in ServiceNow, the selected SIR Close Code will automatically determine and update the Incident Classification field in the corresponding Microsoft Defender incident.
Options include:
- Default incident classification.
- Incident classification-SIR close code mapping.
</td></tr><tr><td>
Defender Pull Closed Incidents
</td><td>
Pull Closed Incidents
</td><td>
Option to fetch closed incidents during ongoing ingestion and one-time retrieval. Closed SIR incidents won’t be updated with new data from Defender.
</td></tr><tr><td rowspan="2">
Defender Incident Comments and SIR Work notes synchronization
</td><td>
Update SIR work notes with Defender incident comments
</td><td>
Option to synchronize Security Incident work notes to Defender incident comments. Work notes added to the Security Incidents in ServiceNow appears with the prefix- Comment from Defender ID.
</td></tr><tr><td>
Update Defender incident comments with SIR work notes
</td><td>
Option to update your SIR work notes in the Defender incident comments. The comment in Microsoft Defender appears with the prefix- Comment from ServiceNow.
</td></tr></tbody>
</table> \[Omitted image "ms-def-additional-op.png"\] Alt text: Options for automating incidents
3. Select **Finish**.
4. Activate the profile.
1. Select the **Name** section of the progress bar.
2. Select the **Active** check box.
3. Select **Continue**.
| title | Automate incident updates and closures |
| description | Automate incident updates and closures based on the incident status. The Microsoft Defender integration has a bi-directional interface that enables incidents to create security incidents and to update the incidents after the security incident is created or closed. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/ms-defender-additional-op.html |
| release | australia |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | task |
| last_updated | 2026-09-10 |
| reading_time_minutes | 2 |
| breadcrumb | Microsoft Defender integration for Security OperationsSecurity Incident Response integrationsSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |