Microsoft Security Operations AnalystMitigate threats using Microsoft Defender XDREasy
An organization is using Microsoft Defender XDR. A security analyst receives an alert indicating a 'Suspicious process injection' on a critical server protected by Defender for Endpoint. The analyst needs to quickly understand if this activity is part of a larger attack chain involving other assets or identities within the organization. Which unified capability within the Microsoft Defender Portal allows the analyst to see the full scope of related alerts and affected entities across different Defender products?
- AAction center
- BIncidents
- CDevice inventory
- DAlerts queue
Show answer & explanationAnswer & explanation
Correct answer: B. Incidents
The 'Incidents' feature in the Microsoft Defender Portal automatically correlates related alerts from Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps into a single, comprehensive view, providing the full attack story and affected entities.
Why the other options are wrong
- A. The action center manages pending and completed remediation actions, not the correlation and investigation of an attack's full scope.
- C. Device inventory lists all onboarded devices but doesn't correlate alerts into an attack story.
- D. The alerts queue shows individual alerts but doesn't automatically group them into a cohesive incident that tells the full attack story.
Microsoft Defender XDR Incidents
The central feature in Microsoft Defender XDR that automatically correlates related alerts from various Defender products into a single, comprehensive attack story, providing context and streamlining investigation.
- Aggregates alerts across Endpoint, Identity, Office 365, and Cloud Apps.
- Shows the full attack chain, affected assets, and user accounts.
- Enables unified investigation and remediation.
Memory trick: To see the full attack picture, you need to piece together all the incidents.