L6. Incident Management: Correlation, Triage and Response

How Alerts Become Incidents

Defender XDR groups related alerts into incidents using its correlation engine. The engine considers:

• Entity mapping: Alerts sharing the same user, device, mailbox, or IP address
• Temporal correlation: Alerts occurring within a related timeframe
• Attack pattern matching: Known attack sequences mapped to MITRE ATT&CK

A single incident can contain alerts from multiple Defender products. For example, an incident might include a phishing alert (Office 365), a suspicious sign-in (Identity), malware execution (Endpoint), and data exfiltration to a cloud app (Cloud Apps).

The Incident Queue

The incident queue at security.microsoft.com > Incidents is the SOC analyst's primary workspace. Each incident shows:

• Severity: High, Medium, Low, Informational
• Status: New, In progress, Resolved
• Classification: True positive, Informational (expected), False positive
• Determination: Multi-select values like Malware, Phishing, Compromised account
• Assignment: Assigned analyst or team
• Category: MITRE ATT&CK tactic (Initial Access, Execution, etc.)

Filters let analysts focus on specific severities, statuses, categories, data sources, or assigned owners. Exam tip: The exam tests your ability to choose the correct classification and determination for a given scenario. A penetration test by a hired firm is classified as "True positive" with determination "Security testing."

Investigation Graph

The investigation graph visualizes the relationships between entities in an incident:

• Users, devices, mailboxes, and IP addresses involved
• Files and processes executed
• Alerts triggered and their timeline
• Related evidence and artifacts

Clicking any entity opens its detailed page with full context: activity timeline, alerts, group memberships (for users), installed software (for devices), and related incidents.

Response Actions

Incident response actions in Defender XDR span all workloads:

Automated Investigation and Response

When an incident triggers Automated Investigation and Response (AIR):

1. AIR examines all alerts and entities in the incident
2. It expands the investigation to check for related suspicious activity
3. It produces a list of recommended remediation actions
4. Depending on the automation level, actions are applied automatically or queued for approval

The Action center at security.microsoft.com shows all pending and completed actions across the organization.

Incident Classification Workflow

A practical triage workflow for the exam:

1. Review the incident summary and alert evidence
2. Check the investigation graph for entity relationships
3. Open entity pages to review activity timelines
4. Determine if the activity is malicious, expected, or a false positive
5. Set the classification, determination, and add comments
6. Take response actions or trigger AIR
7. Resolve the incident when all alerts are addressed

Linking and Merging Incidents

If two incidents are related but were not automatically correlated, analysts can link them manually. The linked incidents share context, and resolving one does not automatically resolve the other.