This rule promotes Defender XDR incidents from the logs-m365_defender.incident-* data stream into Elastic as a single, consolidated detection alert per incident. Microsoft Defender may generate multiple update events for the same incident as member alerts and classifications evolve; this rule groups updates by the Defender incident id (and tenant id) and surfaces one Elastic alert per incident, enabling analysts to investigate within the Elastic Security app without noise from per-update alerts. It uses a query that targets Defender incident alerts (event.kind: alert) within the m365_defender.incident dataset. Alert suppression ensures subsequent updates are merged into the open Elastic alert for the same incident for a configurable window (default 24 hours). The rule maps Defender incident severity to Elastic severities and provides extensive triage guidance, correlation fields, and Defender portal pivots to assist responders. It also notes that enabling this rule may affect alert duplication with the separate Defender Alert External Alerts rule, recommending one of the two promotion rules to avoid duplicates. The rule is designed to facilitate rapid investigation of Defender incidents directly in Elastic, with recommended remediation steps and investigative angles. It is governed by a moderate risk score, a 1-minute interval, and a 1000-signal cap, making it suitable for continuous incident tracking across Defender incidents as they are ingested.