3.6. Reflection Checkpoint

Key Takeaways

• Work incidents, not alerts: triage the unified queue by severity and source, assign ownership, read the attack story and graph, merge or link when correlation missed a connection, and use cases to coordinate work across incidents or for hunts and IoC tracking. Security Copilot summarizes, explains scripts, drafts KQL, and recommends actions; agents such as the Phishing Triage Agent triage within their own identity and permissions while analysts keep the final say.
• Respond in the product that owns the compromised asset: Defender for Office 365 for email (remediate every copy, block in the Tenant Allow/Block List), Entra ID Protection for cloud identity risk (confirm compromise, revoke sessions, reset password), Defender for Identity for on-premises AD attacks, Defender for Cloud Apps for in-app behavior and OAuth apps, and Purview for data movement.
• Cloud workload alerts from Defender for Cloud come with take-action guidance and workflow automation; Sentinel incidents rely on entity mapping, entity pages, and UEBA, and synchronize status and comments with the Defender portal.
• Endpoint response is a ladder: investigate with the timeline and entity pages, preserve evidence with an investigation package, then contain with the least disruptive action that stops the attacker (quarantine, restrict app execution, selective or full isolation, contain device or user). Live response needs enablement, the right permission tier, and library scripts.
• Microsoft 365 forensics uses three sources: the audit log for activity (180 days Standard, a year Premium, MailItemsAccessed to scope what was read), Content search for where content exists, and Graph activity logs for API requests, which must be exported before an incident to be available.

Connecting Forward

Phase 4 turns from reacting to hunting: choosing the right advanced hunting tables, writing KQL that finds threats detections missed, interpreting threat analytics, mapping blast radius with hunting graphs and the Sentinel graph, and hunting at scale in the Sentinel platform with hunting queries, KQL jobs, summary rules, notebooks, and the Sentinel MCP server.

Self-Check Questions

• A user reports a phishing email; threat hunting shows 60 recipients, 4 clicks, and one of the clickers' accounts signing in from an unfamiliar country 10 minutes later. List the response actions in order, naming the product and the specific action for each.
• An incident shows Kerberoasting from a workstation, followed by pass-the-hash to a file server. Which product raised each alert, what does the lateral movement path tell you, and which accounts and devices do you contain first?
• Legal asks which messages an attacker read in the CFO's mailbox over the past three weeks and whether an OAuth app exported files from SharePoint. For each question, name the data source, the prerequisite that must have been in place, and one specific event or field you'd look for.