MC1228325 – (Public Preview) New built in alert tuning rules for Microsoft Defender for Endpoint in Microsoft Defender XDR

Product:

Defender, Defender for Endpoint, Defender XDR

Platform:

Online, World tenant

Status:

Change type:

Admin impact

Links:

Details:

Summary:
Microsoft Defender XDR will add six new built-in alert tuning rules for Microsoft Defender for Endpoint starting February 8, 2026, to reduce low-priority alerts. Rules are visible for review until February 18, then activate by default but can be disabled anytime by admins. No action needed for default use.

Details:
[Introduction]
Microsoft Defender XDR is adding six new Microsoft-curated built-in alert tuning rules for Microsoft Defender for Endpoint (MDE) to help reduce low-priority endpoint alerts reaching your queues.
[When this will happen:]
February 8, 2026: Rules become visible in the portal (Preview) for review.
February 8-February 18, 2026: Rules are visible but not active, so you can review and opt out if needed.
February 18, 2026: Rules become active by default.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:

Created:
2026-02-07

updated:
2026-02-07

Task Type

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS How does it affect me

XXXXXXX ... free basic plan only

MS Preperations

XXXXXXX ... free basic plan only

MS Urgency

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

summary for non-techies**

Starting February 8, 2026, Microsoft Defender XDR will introduce six new alert tuning rules to automatically filter out low-priority security alerts, with these rules becoming active by February 18, 2026, unless manually adjusted by admins, allowing for consistent and efficient alert management across multiple teams or offices.

Direct effects for Operations**

Reduction of Alert Visibility
With the new built-in alert tuning rules, low-priority alerts will be automatically handled, leading to fewer alerts visible in the incident/alert queues. This may cause admins to miss important low-severity alerts that could indicate underlying issues.
   - roles: IT Admin, Security Analyst
   - references: https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts?tabs=settings#built-in-alert-tuning-rules, https://techcommunity.microsoft.com/category/microsoft-defender-xdr/blog/microsoftthreatprotectionblog

Potential Over-reliance on Automation
The automatic handling of alerts may lead to an over-reliance on the system, causing admins to become less vigilant in monitoring alerts and potentially overlooking critical security incidents that require manual intervention.
   - roles: IT Admin, Security Analyst
   - references: https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts?tabs=settings#built-in-alert-tuning-rules, https://techcommunity.microsoft.com/category/microsoft-defender-xdr/blog/microsoftthreatprotectionblog

Configutation Options**

XXXXXXX ... paid membership only

IT Security**

XXXXXXX ... paid membership only

explanation for non-techies**

XXXXXXX ... free basic plan only