[Feature Request]: Defender Incidents and Alerts DBCache

[Admin-GitEnterprise-bais365]

Please confirm:

• I have searched existing feature requests (open and closed) and found no duplicates.
• **Me or my organization is currently an active sponsor of the product at the $99,- level.

Problem Statement

Cache the Incidents and Alerts so it can be pulled for custom tests and report builder
Load quickly for tenants that got a lot of incidents/alerts - right now large customers we got sometimes cant load the incidents page at all

Benefits for MSPs

manage incidents easier and pull data for incident reports using custom tests or report builder

Value or Importance

a lot of our larger tenants cant load the incidents/alerts page and we still have to revert to native portal

PowerShell Commands (Optional)

No response

[kris6673]

This is one of those hard ones, as it can create a lot of confusion if the data is not pulled live. Some techs use CIPP, others use the Defender portal, and if it was cached, the changes in assignment and status would not flow back into CIPP, which would very likely cause multiple tech to be working on the same incident without knowing it.

I think the solution here would be to pull less alerts and incidents using the already available date filter, and not cache them instead.