Schedule incident retrieval

task brazil Updated Sep 10, 2026 1 min read ms-defender-schedule-inc.md

Set a schedule that determines how frequently Microsoft Defender incidents are pulled into SIR to ensure timely and efficient ingestion.

Before you begin

Role required: sn_si.admin, sn_si.ingestion_profile_admin

Procedure

If you aren’t continuing from the previous section of the Filtering and Aggregation criteria, access the profile you’re defining.
1. Navigate to All > Microsoft Defender Integration > Defender Incident Profiles.
2. Select the profile that you’re continuing to define.
3. Select Scheduling in the progress bar.
On the form, fill in the fields.

Field	Description
Ongoing incident ingestion	Option to set ongoing incident ingestion that the ServiceNow AI Platform instance pulls from the Microsoft tenant for new incidents. Security incidents are created if triggered incidents are found and the incident generation filtering criteria matches.
Polling increment (minutes)	Polling frequency defined in minutes.
Set incident ingestion time	Option to add Date and time for the initial ingestion.
Input incident ingestion time	Date and time that you specify for the incident ingestion.
One-Time Retrieval	Option to enable one-time retrieval of historical Microsoft Defender incidents and followed by the reconciliation of the data.When processing the data, both ongoing incidents and historical data are pulled. Note: The retrieved historical Microsoft Defender incidents undergo de-duplication checks to avoid any duplicates within the Security Incident Response application.
Since date	The date since historical incidents were ingested from Microsoft.

\[Omitted image "ms-def-scheduling.png"\] Alt text: Schedule incident retrieval

Select Continue.

What to do next

Automate incident updates and closures

103 lines · 2.9 KB Wrap lines

---
title: Schedule incident retrieval
description: Set a schedule that determines how frequently Microsoft Defender incidents are pulled into SIR to ensure timely and efficient ingestion.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/security-incident-response/ms-defender-schedule-inc.html
release: brazil
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Microsoft Defender integration for Security Operations, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Schedule incident retrieval

Set a schedule that determines how frequently Microsoft Defender incidents are pulled into SIR to ensure timely and efficient ingestion.

## Before you begin

Role required: sn\_si.admin, sn\_si.ingestion\_profile\_admin

## Procedure

1.  If you aren’t continuing from the previous section of the Filtering and Aggregation criteria, access the profile you’re defining.

    1.  Navigate to **All** &gt; **Microsoft Defender Integration** &gt; **Defender Incident Profiles**.

    2.  Select the profile that you’re continuing to define.

    3.  Select **Scheduling** in the progress bar.

2.  On the form, fill in the fields.

<table id="table_kyc_qbg_p4b"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Ongoing incident ingestion

</td><td>

Option to set ongoing incident ingestion that the ServiceNow AI Platform instance pulls from the Microsoft tenant for new incidents. Security incidents are created if triggered incidents are found and the incident generation filtering criteria matches.

</td></tr><tr><td>

Polling increment \(minutes\)

</td><td>

Polling frequency defined in minutes.

</td></tr><tr><td>

Set incident ingestion time

</td><td>

Option to add Date and time for the initial ingestion.

</td></tr><tr><td>

Input incident ingestion time

</td><td>

Date and time that you specify for the incident ingestion.

</td></tr><tr><td>

One-Time Retrieval

</td><td>

Option to enable one-time retrieval of historical Microsoft Defender incidents and followed by the reconciliation of the data.When processing the data, both ongoing incidents and historical data are pulled.

**Note:** The retrieved historical Microsoft Defender incidents undergo de-duplication checks to avoid any duplicates within the Security Incident Response application.

</td></tr><tr><td>

Since date

</td><td>

The date since historical incidents were ingested from Microsoft.

</td></tr></tbody>
</table>    \[Omitted image "ms-def-scheduling.png"\] Alt text: Schedule incident retrieval

3.  Select **Continue**.


## What to do next

[Automate incident updates and closures](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/security-incident-response/ms-defender-additional-op.md)