3.1. Investigate Incidents in Microsoft Defender XDR
💡 First Principle: An incident is a hypothesis about one attack, assembled by a correlation engine from many alerts. The analyst's job is to test that hypothesis: confirm what's real, find what the correlation missed, decide scope, and drive the response to completion. Tools in this section exist to make that faster: queues and cases to organize the work, the attack story and graph to understand it, and Security Copilot to compress the reading.
Why care: incident handling is where everything else in the exam meets. Detections from 2.5 produce the alerts, automation from 2.6 shapes the incident before you see it, and the response actions in the rest of Phase 3 are launched from here. Scenario questions often hand you an incident and ask what to do next; the right answer depends on reading the incident correctly.
The mental model is a detective's case board. The incident is the board: alerts are the pinned evidence, entities are the suspects and locations, and the attack story is the string connecting them in order. A case is the investigation file that can hold several boards plus the to-do list and notes. Security Copilot is a fast junior detective who reads every document and drafts a summary, but whose conclusions the lead detective still signs.
⚠️ Common Misconception: "A multi-stage attack shows up as a single alert." Real intrusions trigger alerts across email, identity, endpoint, and cloud products, and the incident's value is in seeing them together. Investigating one alert in isolation misses lateral movement and persistence. A second trap: believing Security Copilot and its agents act unsupervised. They summarize, recommend, and triage within defined permissions, and analysts remain accountable for decisions and can override verdicts.
