L1. Defender XDR: Architecture and the Unified Portal

A suspicious email arrives. Minutes later, the same employee has an unusual sign-in and a device alert. Do you investigate three separate problems? Start by checking their shared evidence. In this lesson, you'll learn how Defender X D R connects the story, and what an analyst still needs to verify.

An alert describes a detection. An incident brings related alerts and affected entities together. Defender X D R can correlate evidence across supported Microsoft security workloads. That gives you an investigation starting point, not a verdict. A shared user or device helps explain a relationship, but you still need to check timing and context.

Here is a fictional example. A message reaches a mailbox at nine ten. An unusual sign-in follows four minutes later. Then an endpoint detection appears. Compare the account, device, and timestamps. If they line up, investigate the possible chain. If they do not, avoid forcing unrelated activity into one explanation.

Viewing an incident and taking a response action are different permissions. Microsoft Defender unified role based access control provides granular permissions and scope. Check the active permissions model and enabled workloads in your tenant. Do not assume that a role name or a familiar portal page grants every action. Licensing also varies by capability.

Open the incident, review its alerts, and inspect the affected identities and devices. Note what supports the suspected sequence and what evidence is missing. Choose a proportionate next action, following your organization's response process. An automatic correlation does not remove the need for an owner, a recorded rationale, or verification after containment.

Two alerts mention the same employee, but they occurred weeks apart on different devices. Is that enough to declare a single attack? Pause and decide what you would inspect next.

No. Shared identity is a lead, not proof of a common incident. Check the time window, device context, and supporting activity. Remember the workflow: connect signals, validate the relationship, and record the next step. Use the linked lesson for practice. This series teaches focused workflows; use Microsoft's current study guide to check full exam coverage.