3.4.1. Device Timelines, Evidence, and Entities

💡 First Principle: An alert tells you that something happened; the device timeline tells you what happened around it. Reconstructing the minutes before and after an alert (what launched the suspicious process, what it wrote, where it connected) is how you separate a one-off false alarm from an intrusion and find every artifact you must remediate.

The device page gathers everything about one endpoint: overview (risk level, exposure, OS, logged-on users, device group), alerts and incidents, timeline, security recommendations, software inventory, and missing updates. The timeline lists events chronologically, including process creations, file changes, network connections, logons, registry changes, and alerts, with filters for event type, user, and time, plus a search box. You can flag important events and mark them to build a narrative, then export the timeline. Selecting an event opens its details, including the process tree showing the parent and child chain (for example, winword.exe spawning powershell.exe spawning rundll32.exe).

Each artifact is also an entity with its own page, which is how you widen the investigation:

• File page: prevalence across the organization (how many devices have seen this hash), first and last seen, signer, threat intelligence detections, and actions (stop and quarantine, add indicator, collect file, deep analysis).
• IP address and domain pages: which devices communicated with it, when, and threat intelligence context.
• User page: the user's devices, alerts, logons, and Entra ID and Defender for Identity information.

Evidence and response on an incident lists every piece of evidence (files, processes, registry values, mailboxes, IPs) with its verdict and remediation status, so you can see what AIR handled and what's left. The investigation graph of an automated investigation shows the same evidence visually.

The skill the exam tests is pivoting: from an alert to the device timeline, from a suspicious process to its file page, from the file page's prevalence to every other affected device. A file seen on one device is a contained incident; the same file seen on 40 devices is an outbreak.

⚠️ Exam Trap: "Determine whether a malicious file found on one device exists anywhere else in the organization" is answered from the file page's prevalence and device list (or an advanced hunting query on DeviceFileEvents by SHA256), not by running a full antivirus scan on every device.

Reflection Question: An alert fires for a suspicious rundll32.exe execution. Describe the pivots you'd make from the alert to establish the infection's entry point and its spread.