Incident Triage: From Alert to Verdict

What happens when an incident lands?

The incident lifecycle

Every incident follows this flow:

Stage	What Happens	Who Does It
1. Detection	Analytics rule, custom detection, or product alert fires	Automated
2. Triage	Assess severity, check if real, assign to analyst	Tier 1 analyst
3. Investigation	Examine evidence, trace the attack chain, identify scope	Tier 1-2 analyst
4. Containment	Stop the attack from spreading (isolate, block, disable)	Analyst or automated
5. Remediation	Remove the threat (quarantine files, reset passwords, clean devices)	Analyst or automated
6. Classification	Mark as True Positive, False Positive, or Benign True Positive	Analyst
7. Closure	Document findings, close the incident, update detections	Analyst

Defender for Office 365: email threats

Email is the number one attack vector. Defender for Office 365 (MDO) detects phishing, malware, business email compromise (BEC), and spam.

Common email threats

Threat	What It Is	MDO Detection
Phishing	Fake email tricking users into revealing credentials	URL detonation, impersonation detection, sender intelligence
Malware	Email with malicious attachment	Safe Attachments sandboxing, file detonation
BEC	Attacker impersonating CEO/CFO to request wire transfers	Display name impersonation, mailbox intelligence
Spam	Unwanted bulk email	Content filtering, sender reputation

Investigation workflow for email threats

1. Review the alert — what triggered it? (Phishing URL, malicious attachment, impersonation)
2. Check the email — sender, recipients, subject, URLs, attachments
3. Trace delivery — was the email delivered, quarantined, or blocked?
4. Check user actions — did anyone click the URL? Did anyone open the attachment?
5. Remediate — soft delete from mailboxes, block sender, purge the email across the org
6. Hunt — search for related emails from the same campaign

💡 Scenario: James triages a phishing campaign

James at Pacific Meridian receives a High-severity incident: “Multi-stage phishing detected — 47 users targeted.”

Triage (2 minutes):

• Incident shows 47 emails from hr-updates@pacificmeridian-careers.com (impersonating the real HR domain)
• 12 users clicked the link; 3 submitted credentials on the fake login page
• Attack disruption automatically disabled the 3 compromised accounts

Investigation (15 minutes):

• Email headers show the sender IP is from a known phishing infrastructure
• The URL redirects to a credential harvesting site (verified via URL detonation)
• The 3 compromised accounts show sign-in activity from the attacker’s IP

Remediation:

• Soft delete all 47 emails across all mailboxes
• Reset passwords for the 3 compromised accounts
• Revoke all active sessions
• Block the sender domain and URL as indicators

Classification: True Positive — Phishing

Post-incident: James creates an analytics rule to detect future emails from similar impersonation domains.

Case management

Case management in Defender XDR provides the workflow structure for managing incidents from detection to closure.

Key case management features

Feature	What It Does
Assign owner	Route incident to a specific analyst
Set status	Active, In Progress, Resolved
Classification	True Positive, False Positive, Benign True Positive (informational)
Determination	Subcategory: Phishing, Malware, Compromised Account, etc.
Tags	Custom labels for tracking (e.g., “VIP”, “Compliance”, “Campaign-2026-04”)
Comments	Analyst notes documenting investigation steps and findings
Linked incidents	Connect related incidents across time

💡 Exam tip: classification vs determination

The exam tests whether you know the difference:

• Classification = Is the incident real? (True Positive, False Positive, Benign True Positive)
• Determination = What type of threat? (Phishing, Malware, Unwanted Software, Line-of-Business Application, etc.)

Both are set when closing an incident. Getting them wrong skews your SOC metrics.

Benign True Positive means the detection was technically correct (something suspicious happened), but it was expected or authorised (e.g., a penetration test triggering alerts).

Automatic attack disruption in action

You learned about attack disruption in Module 7. Here is how it appears during triage:

When you open an incident that was disrupted, you see:

• Yellow banner — “Attack disruption actions have been taken”
• Contained entities — which devices were isolated, which users were suspended
• Timeline — when the disruption fired relative to the original alert

As a responder, your job is to verify the disruption was appropriate and continue the investigation. Disruption buys time; it does not complete the investigation.

Question

What are the three incident classifications in Defender XDR?

Click or press Enter to reveal answer

Answer

1. True Positive — a real security threat that requires remediation. 2. False Positive — the detection was incorrect; no actual threat exists. 3. Benign True Positive (Informational) — the detection was technically correct, but the activity was expected or authorised.

Click to flip back

Question

When you find 3 compromised accounts from a phishing campaign, what are the immediate remediation steps?

Click or press Enter to reveal answer

Answer

1. Reset passwords for all compromised accounts. 2. Revoke all active sessions and tokens. 3. Soft delete the phishing emails from all mailboxes. 4. Block the phishing URL and sender domain as indicators. 5. Check for mailbox forwarding rules the attacker may have created.

Click to flip back

Question

What does the yellow banner 'Attack disruption actions have been taken' mean during triage?

Click or press Enter to reveal answer

Answer

Defender XDR's automatic attack disruption has already contained the threat — devices may be isolated, user accounts suspended. The analyst's job is to verify the disruption was appropriate and continue the investigation. Disruption buys time but does not complete the response.

Click to flip back

Knowledge Check

James finds that Defender XDR disabled 3 user accounts during a BEC incident. One of the accounts belongs to the CFO, who cannot access email during a board meeting. What should James do?

AImmediately re-enable all 3 accounts — the disruption was too aggressiveBVerify the CFO's account was truly compromised. If it was a false positive, re-enable with a password reset. If compromised, keep it disabled and brief the CISO.CWait for the automated investigation to complete before taking any actionDDisable attack disruption to prevent future business impact

Check Answer

Knowledge Check

A penetration testing team triggers alerts in Defender XDR during an authorised test. How should the SOC classify these incidents?

ATrue Positive — the detections are working correctlyBFalse Positive — the test is not a real attackCBenign True Positive (Informational) — the detection is correct, but the activity is authorisedDDo not classify — just delete the incidents

Check Answer

🎬 Video coming soon

Next up: Email threats are handled. Now let’s investigate threats from Microsoft Purview and Defender for Cloud — data breaches and cloud workload attacks.