incident-investigation

Security incident investigation is automated by orchestrating metadata retrieval, alert listing, and entity analysis using Defender XDR and Sentinel MCP tools. Supply an incident ID, select a mandatory Sentinel workspace, and generate structured findings.

Evidence extraction during a security incident enumerates devices, users, apps, and cloud resources while filtering malicious processes, files, IPs, URLs, and domains. It defangs indicators to safely present actionable entity summaries for reporting.

Yes, parallel investigation across users, devices, and IoCs is supported after mandatory Sentinel workspace selection. The workflow coordinates user-investigation, computer-investigation, and ioc-investigation skills to surface structured findings simultaneously.

Incident investigation supports Phase 1-3 workflows with phase-tracking for auditability. It guides operators through a reproducible process from incident description to actionable results, ensuring structured outputs ready for reporting.

Start an end-to-end security incident investigation by supplying an incident ID, then select assets and entities for deeper analysis. The workflow retrieves incident metadata including title, severity, status, and MITRE techniques before entity analysis.

Sentinel MCP and Defender XDR incident analysis requires installing prerequisites and having valid incident IDs. Mandatory Sentinel workspace selection is enforced before any metadata retrieval, alert listing, or entity investigation can proceed.