Microsoft Defender Incident Question

I’m investigating an incident in Defender and it has 2 alerts associated with it: 1) email reported by user as malware or phish 2) external user added. Is there a way to break these into 2 separate incidents because one of the alerts is true positive and one is a false positive. Managing the alert doesn’t manage the incident. I’ve tried to look this up on Microsoft but haven’t found anything about separating them. Any help would be appreciated. Thanks.

alert alerts cybersecurity defender email external false positive incident incidents malware microsoft microsoft defender phish question