Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
5.2. Quick Reference
Decision tables compressing Phases 2 through 4. If a row surprises you, revisit its section.
Platform and Ingestion
| Requirement | Answer | Not |
|---|---|---|
| Analysts manage incidents and run playbooks manually | Sentinel Responder + Playbook Operator (2.1.1) | Sentinel Contributor, Logic App Contributor |
| Engineers build analytics rules and playbooks | Sentinel Contributor + Logic App Contributor (2.1.1) | Owner |
| Automation rules can't run a playbook | Grant the Sentinel service account permission on the playbook resource group (2.1.1) | Give analysts more roles |
| Real-time detections on a data source | Analytics tier (2.1.2) | Data lake only |
| Keep logs for years at lowest cost | Total retention in the data lake (2.1.2) | Long analytics retention |
| Find costly low-value tables or coverage gaps | SOC optimization recommendations (2.1.3) | Custom workbook |
| Windows security events from servers | Windows Security Events via AMA → SecurityEvent (2.2.2) | Legacy Log Analytics agent |
| Centralized events from a WEF collector | Windows Forwarded Events → WindowsEvent (2.2.2) | SecurityEvent |
| Firewall CEF logs | CEF via AMA on a Linux forwarder → CommonSecurityLog (2.2.3) | Direct to workspace |
| Activity logs for all current and future subscriptions | Azure Policy at management group + remediation task (2.2.4) | Manual diagnostic settings |
| Import a STIX/TAXII feed | Threat Intelligence - TAXII connector + matching rule (2.2.5) | Connector alone |
| In-house app logs | DCR-based custom _CL table + Logs Ingestion API (2.2.5) | Basic Syslog |
Defender for Endpoint and Defender XDR
| Requirement | Answer | Not |
|---|---|---|
| Collect extra endpoint events for specific servers | Custom data collection targeted by dynamic tags → DeviceCustom* tables (2.3.1) | Manual tags |
| Roll out ASR rules safely | Audit → review → exclusions → block or warn (2.3.2) | Block immediately |
| Different automation level for one server set | Device group ranked above broader groups (2.3.3) | Lower rank |
| Hide a known-benign recurring alert | Alert tuning rule with narrow conditions (2.4.1) | Disable the detection |
| AIR found threats but didn't remediate | Approve pending actions in Action center or raise automation level (2.4.2) | Rerun investigation |
| Never auto-contain a critical device | Attack disruption exclusion (2.4.3) | Disable disruption tenant-wide |
Detections and Automation
| Requirement | Answer | Not |
|---|---|---|
| Detect on XDR data and isolate the device automatically | Custom detection with Isolate device action (2.5.1) | Hunting query |
| Alert within about a minute on one high-value event | NRT rule or continuous custom detection (2.5.1, 2.5.2) | 14-day multi-table scheduled logic |
| Consolidate noisy per-event incidents | Event grouping + alert grouping with entity mapping (2.5.2) | Disable rule |
| Tune a built-in anomaly rule safely | Duplicate it and run the copy in Flighting (2.5.3) | Edit the original |
| Close test incidents before paging rules run | Automation rule with a lower order number (2.6.1) | Same order number |
| Temporary suppression during a pen test | Automation rule with an expiration date (2.6.1) | Permanent tuning |
| Playbook fails to disable an Entra user | Grant the playbook's managed identity the needed Entra role (2.6.2) | Analyst's role |
Response
| Requirement | Answer | Not |
|---|---|---|
| Coordinate work across several incidents with tasks | Case management (3.1.1) | Merge all incidents |
| Phishing agent isn't triaging reported mail | Remove alert tuning that auto-resolves reported phish (3.1.3) | More permissions |
| Remove a phishing campaign from all mailboxes | Threat Explorer remediation + Tenant Allow/Block List (3.2.1) | Delete from one mailbox |
| Deletion pending in Threat Explorer | Analyst lacks Search and Purge; approve in Action center (3.2.1) | Global Administrator |
| Stolen session token (AiTM) | Revoke sessions, confirm compromised (3.2.2) | Password reset alone |
| Malicious OAuth app keeps reading mail | Disable or ban the app, revoke consent (3.2.3) | Reset user password |
| Sentinel incident has no entities | Fix the rule's entity mapping (3.3.2) | Reingest data |
| Preserve evidence before remediation | Collect investigation package (3.4.2) | Reimage first |
| User must keep Teams during isolation | Selective isolation (3.4.2) | Full isolation |
| Run a custom script on a device | Library upload + advanced live response + unsigned script setting if needed (3.4.2) | Basic permission |
| User still blocked after disruption | Release from containment (3.4.3) | Another password reset |
| Which messages an attacker read | MailItemsAccessed audit records (3.5.1) | Message trace |
| Where a leaked file sits across mailboxes | Content search (3.5.2) | Audit log |
| What an app did via Graph | Graph activity logs exported beforehand (3.5.3) | Sign-in logs |
Hunting
| Requirement | Answer | Not |
|---|---|---|
| Which process connected to a C2 domain | DeviceNetworkEvents with InitiatingProcessFileName (4.1.1) | DeviceEvents |
| Latest event per device | summarize arg_max(Timestamp, *) by DeviceId (4.1.2) | take 1 |
| Which of our devices are exposed to a new threat | Threat analytics Endpoints exposure (4.1.3) | Analyst report |
| Fewest changes that remove the most attack paths | Hunting graph choke point scenario (4.2.1) | Incident graph |
| Environment-wide entity relationships | Sentinel graph (4.2.2) | Incident graph |
| Be alerted when a hunting pattern recurs | Create analytics rule or custom detection (4.3.1) | Favorite the query |
| Retro-hunt years of lake data for a new IoC | One-time KQL job to an analytics table (4.3.2) | Summary rule |
| Cheap fast queries over huge verbose logs | Summary rule (4.3.2) | KQL job |
| Python ML over 18 months of lake data | Data lake notebook (4.3.3) | Advanced hunting |
| AI assistant queries lake data with governed access | Sentinel MCP server (4.3.3) | Exported CSVs |
Written byAlvin Varughese
Founder•20 professional certifications