Respond to Security Incidents
What to know
This domain covers the incident lifecycle in Microsoft Sentinel and Microsoft Defender XDR: triage, investigation, evidence gathering, and remediation. Key concepts: incident grouping and entities (accounts, hosts, IPs, URLs), the incident investigation graph, bookmarks and comments, the difference between alerts and incidents, incident tasks, and automated response via automation rules and playbooks. You should also understand Defender XDR's automated investigation and response (AIR), the action center, and how to run advanced hunting queries from an incident.
Traps to expect
- Alert vs. incident. An incident can contain many alerts; closing an incident does not automatically close every underlying alert, and questions often test which object you act on.
- Entity mapping. For playbooks to work, analytics rules must map entities correctly; a missing entity mapping is a common reason an automated action fails.
- Status and classification. Sentinel incidents have status (New, Active, Closed) and, on close, a classification (True Positive, False Positive, Benign, etc.). Questions ask for the correct classification semantics - "Benign Positive" means expected activity that still triggered, not a false alarm.
- Playbook permissions. Playbooks run under a service account or managed identity; missing permissions is the usual reason a playbook fails silently.
Worked example
An incident shows a suspicious sign-in from a new country, and the analyst wants to confirm whether the account also sent mail externally. Rule of thumb: open the incident, use the investigation graph to expand the account entity, pivot to related alerts, then run an advanced hunting query (e.g., against EmailEvents) scoped to that account. Record findings as incident comments/bookmarks before closing with classification True Positive and the appropriate threat category.
Rule of thumb
Triage order: confirm scope (entities) → gather evidence (graph, hunting, bookmarks) → contain (playbook/device isolation) → close with the right classification. Never close as False Positive without documenting why the alert fired.