When Microsoft Defender XDR and Sentinel are fully linked, if an incident is changed or closed in Sentinel, how does that change show up in Defender XDR, and what main problem does this solve for security teams?

When Microsoft Defender XDR, which is Microsoft's unified security operations platform providing Extended Detection and Response (XDR) capabilities across endpoints, identity, email, and cloud applications, is fully linked with Microsoft Sentinel, Microsoft's cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution, a bi-directional synchronization is established for security incidents. If an incident is changed or closed in Sentinel, these updates are automatically reflected in Defender XDR. Specifically, when an incident originating from Defender XDR is ingested into Sentinel, a linked instance is created in Sentinel. If an analyst then modifies key attributes of this incident in Sentinel, such as its status (e.g.,....