If you have a match on TI from the MDTI connector, the TI description may contain a link which gets added to the comments of the incident
The description will read something like:
Please read the linked article(s) for more information on this threat. ["https://ti.defender.microsoft.com/article/90b0380a"]
However when rendered in the portal, the link will be clickable but fail due to the training "] being added in url encoded form making the clickable link:
https://ti.defender.microsoft.com/article/90b0380a%22%5D
This really seems like a comment issue, but we can workaround it by removing the [ ] or replacing it with ( ) which results in the link being correctly rendered
If you have a match on TI from the MDTI connector, the TI description may contain a link which gets added to the comments of the incident
The description will read something like:
Please read the linked article(s) for more information on this threat. ["https://ti.defender.microsoft.com/article/90b0380a"]However when rendered in the portal, the link will be clickable but fail due to the training
"]being added in url encoded form making the clickable link:https://ti.defender.microsoft.com/article/90b0380a%22%5DThis really seems like a comment issue, but we can workaround it by removing the [ ] or replacing it with ( ) which results in the link being correctly rendered