Close Alert As True Positive - Blink Documentation

Integrations
1Password
Abnormal
Absolute
AbuseIPDB
Acronis
Active Directory On-Prem
Adaptive Shield
Adobe Cloud
ADP
Agari Phishing Response
Airlock
Airlock Digital
Akamai Identity Cloud Social
Alert Logic
AlgoSec Firewall Analyzer
Alienvault OTX
Alienvault USM
Anodot
Ansible
Anthropic
Anvilogic
Any Run
Apex One
ArcSight ESM
Ardoq
Area 1
Armis Centrix
Asana
Asset Panda
Astrix
Atlassian Crowd
Atlassian User Management
Atlassian User Provisioning
AuditBoard
auth0
Authentik
Authomize
Automox
AWS
AWS IAM Identity Center
Axonius
Azure
Azure Data Explorer
Azure DevOps
Azure Log Analytics
Azure Storage
BambooHR
Big Fix
BigPanda
Bitbucket
Bitdefender
Bitsight
Bitwarden
Black Duck
Black Kite
Blink
BMC Remedy
Box
Brinqa
Cato Networks
Censys
Chorus
Cisco Advanced Phishing Protection
Cisco Domain Protection
Cisco Meraki
Cisco Talos
Cisco Umbrella
Cisco Webex
Claroty CTD
Claroty xDome
ClearPass
ClickHouse
ClickUp
Cloud Custodian
Cloudflare
Cloudflare R2
Cobalt.io
Check Point Harmony
Check Point Infinity Events
Check Point Management
Check Point XDR/XPR
Checkmarx SAST
Checkmarx One
Chronicle
Compass
Confluence
Confluence Data Center
Coralogix
Coralogix Incident Management
Cortex XDR
Cortex Xpanse
Coupa Compass
CredStash
Cribl
CrowdStrike
CyberArk
Cybersixgill
CyCognito
Cyera
Cylance
Cyware CTIX
Darktrace
Dasera
Databricks
Datadog
DataSet
Delighted
Delinea
Devo
Digital-Shadows
Discord
Docusign
Domo
Drata
Dropbox
Dropbox Business
druva
Duo
Duo Auth
Dynatrace
EasyVista
EchoTrail
Egnyte
Egnyte Secure Govern
Elasticsearch
Entro
Entrust Certificate Services
Ermetic
Exabeam
Exchange Online
Expel
F5
Falcon LogScale
Falcon Surface
Fastly
Flare.io
Forcepoint DLP
Forescout
FortiGate
Freshservice
GCP
Gemini
Ghostwriter
Git
GitHub
GitLab
Glean
Gmail
Google Calendar
Google Chat
Google Docs
Google Drive
Google Forms
Google Looker
Google Meet
Google Sheets
Google Workspace
Grafana
Greenhouse
GreyNoise
Grip Security
GYTPOL
HackerOne
HackNotice
Halo PSA
Have I Been Pwned
HiBob
HubSpot
Hunters
Hybrid Analysis
Hyperproof
IBM CLoud
IBM NS1 Connect
IBM Security Verify
IBM X Force
Imperva
Incident.io
Infobip
Infoblox Cloud Services Portal
Intercom
Intezer
IP API
IPinfo
IPWHOIS
Ironscales
Ivanti RiskSense
Jamf
JetBrains
JFrog
Jira
Jira Data Center
Joe Sandbox
JumpCloud
Kandji
Keeper Secrets Manager
Kenna Security
KnowBe4
KnowBe4 Events
Kubernetes
Lacework
LaunchDarkly
Lark
LimaCharlie
Linear
Litmos
Living Security
LogicMonitor
LogRhythm
Manage Engine ServiceDesk Plus
Mattermost
Maven
Microsoft Defender For Cloud
Microsoft Defender For Cloud Apps
- Overview
- Actions
- Triggers
Microsoft Defender For Endpoints
Microsoft Defender XDR
Microsoft E-Discovery
Microsoft Entra ID
Microsoft Excel
Microsoft Graph
Microsoft Intune
Microsoft Office 365 Management Activity
Microsoft Outlook
Microsoft Purview
Microsoft Sentinel
Microsoft SQL Server
Microsoft Teams
Mimecast
MISP
Monday
MongoDB Atlas
MxToolbox
Neo4j
NetBox
Netography
Netskope
NetSPI
New Relic
Nexthink
Nightfall AI
NinjaOne
Notion
Nozomi Networks
Nuclei
Nucleus
Nutanix Hypervisor
Obsidian
Okta
OneDrive
OneLogin
OneTrust
Oort
OpenAI
OpenCTI
Opsgenie
OPSWAT
Oracle Cloud
Oracle HCM
Oracle NetSuite
Oracle PeopleSoft
Orca Security
OWASP ZAP
PagerDuty
Palo Alto NGFW
Palo Alto Firewall
Panther
Pentera
Perception Point
PhishLabs
PhishLabs Incident Data
PhishLabs Open Web Monitoring
Pingdom
PingID
PingOne
PlexTrac
PortSwigger
Postman
Postman SCIM
Power BI
PowerShell
Prisma Access
Prisma Cloud
Prisma Cloud CWP
Prometheus
Proofpoint
Proofpoint ITM
Proofpoint Protection Server
Proofpoint Security Awareness Training
Proofpoint TAP
Proofpoint TRAP
Pub-Sub
QRadar
Qualys
Rapid7
Rapid7 InsightIDR
Rapid7 InsightVM Cloud
Rapid7 Threat Command
Reco
Recorded Future
Recorded Future Triage Cloud
Red Hat IDM
Rippling
Rubrik
runZero
SafeBase
SafeBreach
Sage HR
SailPoint
SailPoint IdentityIQ
Salesforce
SAP Ariba
Sap Concur
ScienceLogic
Securin
Securin VI
SecurityScorecard
Securonix
Seemplicity
Sekoia.io
SemGrep
SentinelOne
ServiceNow
SharePoint
Shodan
Shopify
Silverfort
Slack
Smartsheet
Snipe IT
Snowflake
Snyk
SolarWinds Information Service
SolarWinds Service Desk
SonarQube
Sophos
Split
Splunk
Splunk Observability
Splunk SOAR
Spur
StrongDM
Sumo Logic
Symantec EDR
Sysdig
Tableau
Tanium
TeamCity
TeamViewer
Telegram
Tempo
Tenable
Tenable Security Center
Terraform
Terraform Cloud
Tessian
TheHive
Thinkst Canary
Thomson Reuters
ThreatQuotient
Trellix Email Security
Trello
Trend Vision One
Twilio
UKG HR
Uptycs
URLScan
Vault
Veracode
Verkada
Vertica
VMware vSphere
VMware Carbon Black
VirusTotal
WeChat
WhatsApp
WhoIs
WildFire
Wiz
Workday
Workspace ONE UEM
YesWeHack
Zendesk
Zero Networks
Zoom
Zscaler Internet Access
Zscaler Private Access

On this page

Basic Parameters
Advanced Parameters
Example Output
Workflow Library Example

Close multiple alerts matching the specified filters as true positive (an alert on a confirmed malicious activity).

External DocumentationTo learn more, visit the Microsoft Defender For Cloud Apps documentation.

Basic Parameters

Parameter	Description
Alert IDs	A comma-separated list of alert IDs to close as true positive. Can be obtained via the `List Alerts` action.
Comment	A comment about why the alerts are dismissed.

Advanced Parameters

Parameter	Description
Allow Contact	Indicating that consent to contact the user is provided. Default value: false.
Contact Email	The email address of the user.
Feedback Text	The text of the feedback.
Send Feedback	Indicating that feedback about this alert is provided. Default value: false.

Example Output

{
	"closed_true_positive": 1
}

Workflow Library Example

Close Alert As True Positive with Microsoft Defender for Cloud Apps and Send Results Via Email

Preview this Workflow on desktop

Close Alert As False Positive Get Activity

Integrations

​Basic Parameters

​Advanced Parameters

​Example Output

​Workflow Library Example

Basic Parameters

Advanced Parameters

Example Output

Workflow Library Example