incident-response

Triage Azure Defender security alerts by classifying incident severity into P0–P3 categories based on impacted accounts, resources, and alert context, with P0 forcing immediate CISO notification. This workflow correlates sign-in activity and related alerts into a structured incident timeline.

Investigating an Azure security incident involves pulling Defender alerts and relevant sign-in logs to build a correlated timeline. This timeline helps determine likely initial access, lateral movement, persistence, and overall impact of the suspected compromise.

Containment recommendations for active Azure security threats include specific actions like revoking sessions, removing MFA methods, and isolating devices. These actions explicitly require IT Manager approval before execution to ensure proper governance.

You can automate incident record creation and remediation documentation for Azure Defender alerts using MCP tool support. This persists auditable incident records and outlines follow-up post-incident review timing for P0 and P1 severity levels.

You need MCP tool support to escalate and contain Azure Defender incidents because the workflow requires tools to list and fetch alerts and sign-in logs and to create auditable incident records while enforcing P0 escalation and IT-approval gates.

Trigger immediate escalation for an Azure security incident when triage classification identifies a P0 severity level based on impacted accounts and alert context, which forces immediate CISO notification and initiates containment recommendations.