incident-investigation

Security incident investigation automates comprehensive data collection of metadata, alerts, assets, and evidence from Microsoft Defender XDR and Sentinel, orchestrating sub-skills for in-depth analysis of users, devices, and indicators of compromise.

Deep diving into security incidents involves pulling all related alerts, identifying involved entities, and guiding analysts through interactive phased triage to select specific users or devices for further investigation.

Yes, incident response with Defender XDR leverages specialized sub-skills for user-investigation, computer-investigation, and ioc-investigation to provide entity-specific analysis of users, devices, and indicators of compromise.

Yes, the incident investigation workflow requires mandatory workspace selection to properly query and retrieve incident metadata, alerts, assets, and evidence from Microsoft Sentinel.

Interactive entity prioritization during security forensics allows analysts to manually select specific involved users or machines identified in the alert data for deeper, targeted analysis.

The best way to handle high-severity alerts is to automatically pull all related alerts, identify involved users and machines, and allow analysts to choose which specific device to investigate further.