Skip to main content

Incidents, alerts, investigation and triage

Microsoft documentedDefender XDR · Source checked 2026-10-22 · Not yet verified in tenant · Sources: [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18]

What it is​

An alert is one detection from one engine: MDE saw a hidden file execute, MDO saw a phish click, Entra ID Protection saw impossible travel. An incident is the container the portal builds around related alerts so you work the attack, not the noise. Correlation groups alerts by shared entities, artifacts, time frame and event sequence, and merges incidents that turn out to be the same attack. Every alert belongs to an incident.

The queue at Incidents and alerts > Incidents is the SOC work list: priority score, severity, status, assignment, tags, classification, and an incident page with the attack story graph. Alert tuning, automated investigation, the Action center and email notifications decide what lands in the queue and what gets fixed without a human.

This covers the legacy incident experience Learn still documents in full; incident cases, in preview, are now recommended. See settings-console for portal switches, the overview for product framing, EDR and hunting for hunting from an incident, and Sentinel analytics and incidents for the Sentinel side.

Licensing and prerequisites​

  • Any Defender XDR workload licence gives you the queue: MDE P2, MDO P2, MDI, MDA, or E5 and E5 Security. Threat analytics is not in MDE P1; Sentinel-only customers see some tabs.
  • Microsoft Threat Intelligence alerts reach the queue only for Sentinel customers using the Defender portal or the Defender XDR connector. Otherwise they appear only in the Microsoft 365 admin center.
  • Roles: Security Reader, Global Reader, Security Operator or Security Administrator to read; Security Operator or Security Administrator to update. Notification rules need Manage security settings. Approving device actions needs Security Administrator, URBAC Security operations \ Security data \ Response (manage), or the MDE RBAC role Active remediation actions. MDO remediation also needs Search and Purge.
  • Graph: SecurityIncident.Read.All to list, SecurityIncident.ReadWrite.All to update, SecurityAlert.Read.All for alerts_v2. Delegated and application both work.
  • Analyst notes need Security Copilot plus the opt-in under Settings > Microsoft Defender XDR > Advanced features. Blast radius needs the Sentinel data lake and Exposure management (read).

How it works​

From alert to incident​

If an alert is sufficiently unique within a time frame, the correlation engine creates a new incident. If it is sufficiently related to existing alerts, from any source, it joins that incident. The criteria and the time frame are proprietary. Incident names are generated from alert attributes and can change as the incident grows, so never key automation on the name.

Correlation continues after creation. When two incidents look alike on entities, artifacts, time frames or event sequences, the source merges into the target: it closes, gets a Redirected tag, and redirects. Alerts, tags, entities and detection rules move across; Defender picks the direction. No merge happens when either is resolved, owners differ, classification or determination differ, the target would pass the entity cap, or, with the optional check on, devices sit in different device groups. Manual merge is five at a time once the blocker is cleared.

Incident severity defaults to the highest alert severity inside it and can move as alerts come and go; no history is kept. Status is Active, In progress, Resolved. Resolving the incident resolves every active alert in it. Assignment is one user or group and flows to all its alerts.

Priority score and the queue​

Defender Queue Assistant scores each incident 0 to 100 from attack disruption signals, threat analytics, severity, MITRE techniques, asset criticality, alert rarity and high profile threats. Red is above 85, orange 15 to 85, gray below 15. Selecting the row, not the name, opens a summary pane with the score factors. The default filter is New or In progress, High to Low, last week; Informational is hidden. CSV export caps at 10,000 records.

Classification and determination​

Classification is the analyst verdict: Not set, True positive, Informational expected activity, False positive. In Graph the enum is unknown, truePositive, informationalExpectedActivity, falsePositive. Determinations:

ClassificationDetermination values
True positivemultiStagedAttack, maliciousUserActivity, compromisedAccount, malware, phishing, unwantedSoftware, other
Informational, expected activitysecurityTesting, lineOfBusinessApplication, confirmedActivity, other
False positivenotMalicious, notEnoughDataToValidate, other

The legacy Defender XDR API uses PascalCase (TruePositive, Clean, InsufficientData); Graph uses camelCase and different words for the false positive pair.

Investigation surfaces on the incident page​

The attack story tab is the incident graph: alerts, devices, users, mailboxes and artifacts as nodes you can play in order, filter by severity, status and service source, and thin by hiding entity types. Each node opens an entity pane with response actions; Go hunt pivots into Advanced hunting with the entity pre-filled. Blast radius draws possible propagation paths to critical targets, capped at seven hops.

Other tabs: Alerts, Activities (audit log), Assets, Investigations (AIR runs; MDO alerts show zero here by design), Evidence and Response (every analysed entity with verdict and remediation status, approve or reject for pending items), Summary (MITRE kill chain, scope by risk) and Similar incidents.

Copilot: Learn documents analyst notes generated from the three dot menu in up to 20 minutes, and a Copilot incident summary in the PDF export when licensed.

Automated investigation and the Action center​

When an alert that supports AIR creates an incident, an investigation starts, gives each piece of evidence a verdict of Malicious, Suspicious or No threats found, proposes remediation for the first two, and expands scope when an entity shows up elsewhere. Devices come from MDE, email from MDO, on-premises AD users from MDI. Automatic mode runs the action; approval-based mode parks it in the Action center Pending tab. From 1 September 2026 AIR no longer runs as a separate or on-demand experience for MDE alerts; AIR for MDO remains.

The Action center has Pending for approvals, singly or in bulk per action type, and History as the audit log of automated, manual, Live Response, Explorer and hunting actions. Isolate device and Restrict code execution are undoable from History.

Status lifecycle​

Handoff to Sentinel and ITSM​

With the Defender XDR connector, or Sentinel onboarded to the Defender portal, each incident appears in Sentinel within about five minutes and syncs both ways: title, description, severity, custom tags, new comments, owner, status, classification. Active maps to Sentinel New. True positive maps to True Positive, Suspicious activity; False positive to Inaccurate data; Informational expected activity to Benign Positive, Suspicious but expected; Not set to Undetermined. Sentinel incidents cap at 150 alerts. Microsoft incident creation rules are off for Defender-integrated products; use alert tuning or automation rules.

For other SIEMs Learn documents the REST incidents API pull (Splunk, ArcSight, Elastic) and the streaming API (Splunk, QRadar, Elastic), and recommends Graph for new work. TODO: no Learn page used here documents ServiceNow; source it from ServiceNow docs first.

Reports and threat analytics​

Threat analytics is the report feed from Microsoft researchers: actors, campaigns, techniques, vulnerabilities, malware and curated OSINT. Each report has Overview, Analyst report, Related incidents, Impacted assets, Endpoints exposure, Recommended actions and a preview Indicators tab. Related incidents lists your incidents tied to the threat and lets you assign them there; a matching incident shows the report on its own page, and custom detection rules can be linked to a report. Volume reporting is the 24 hour chart on the queue, Defender Boxed each January and July, and the single incident PDF export. TODO: the Reports > Incidents and alerts page was not among the sources fetched.

Configure​

Work an incident from the queue:

  1. Incidents and alerts > Incidents. Set time range and filters. Save a filter set or bookmark the URL.
The legacy incident queue. Default view is New and In progress, High to Low, last seven days. Source: Microsoft Learn, CC BY 4.0.
The legacy incident queue. Default view is New and In progress, High to Low, last seven days. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  1. Select the row, then Manage incident. Or tick several rows and use Manage incidents on the toolbar.
  2. Set Assign to, Severity, Status, Classification with determination, and tags. White tags are custom; red or black are system tags such as attack disruption, Defender Experts or critical asset.
Classification picker. True positive, Informational expected activity and False positive each expand into a determination list. Source: Microsoft Learn, CC BY 4.0.
Classification picker. True positive, Informational expected activity and False positive each expand into a determination list. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  1. To close, set Status to Resolved, type the resolution note, Save. All active alerts resolve with it.
  2. On the incident page, Evidence and Response approves or rejects pending remediation in place.
Evidence and Response tab: verdict and remediation status per entity, with approve and reject for Pending approval items. Source: Microsoft Learn, CC BY 4.0.
Evidence and Response tab: verdict and remediation status per entity, with approve and reject for Pending approval items. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Alert tuning rule:

  1. Settings > Microsoft Defender XDR > Alert tuning > Add new rule, or Tune alert from an alert page, which pre-fills scope.
  2. Select service sources, and optionally detection sources inside each (preview, effective 8 November 2026). Only services you have permission for are listed.
Service and detection source picker in the Tune alert pane. Source: Microsoft Learn, CC BY 4.0.
Service and detection source picker in the Tune alert pane. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  1. Add conditions on file, process, scheduled task, AMSI script, WMI event and other IOC types, combined with AND, OR and grouping. Values are not case sensitive, some take wildcards, up to 200 per rule.
IOC type menu for a tuning condition. Source: Microsoft Learn, CC BY 4.0.
IOC type menu for a tuning condition. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  1. Pick the action. Hide alert suppresses it and prevents incident creation, MDE alerts only; the alert still lands in AlertInfo and AlertEvidence. Resolve alert creates the alert and its incident already resolved. Set as behavior turns the signal into a behavior in BehaviorInfo and BehaviorEntities, not supported for Defender for Cloud or MDO alerts. Learn documents no change severity action; severity is edited manually on the incident, or per policy for MDO alert policies.
  2. Name, comment, Save. Review the built-in rules on the same page and disable any you do not want.

Incident email notification rule:

  1. Settings > Microsoft Defender XDR > Email notifications > Incidents > Add incident notification rule.
  2. Basics: name and description.
  3. Notification settings: alert severities, device group scope, Send only one notification per incident, include organisation name, include tenant specific portal link. Learn also describes choosing service and detection sources with severities per source.
Notification settings page for an incident email rule. Source: Microsoft Learn, CC BY 4.0.
Notification settings page for an incident email rule. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22
  1. Recipients: add each address, Send test email, Create rule. New recipients only get incidents created after they were added.

Incident settings: Automatically resolve alerts and Restrict correlation to within scoped device groups sit under Settings > Endpoints > Advanced features; the analyst notes opt-in under Settings > Microsoft Defender XDR > Advanced features. See settings-console.

Action center: Actions and submissions > Action center > Pending. Tick items of one type, Approve or Reject.

Action center sort, filter and column controls. Source: Microsoft Learn, CC BY 4.0.
Action center sort, filter and column controls. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Verify​

  • Queue: filter Incident assignment to yourself; the incident you patched through Graph shows the new owner and tags.
  • Activity log: three dot menu > Activities. Graph edits show as API-App:<upn> in lastModifiedBy.
  • Tuning rule: trigger the benign condition again. Hide alert means nothing in the queue but a row in AlertInfo. Resolve alert means a new incident already Resolved. Set as behavior means a row in BehaviorInfo.
  • Notification rule: Send test email, then wait for the next qualifying incident. The email names incident, severity and categories and links to it.
  • Sentinel: the same incident appears within about five minutes with status and classification translated per the mapping table.
  • Action center: approved items move from Pending to History with action source Automated device action or Automated email action.
// Alerts hidden or resolved by tuning still land here; compare against what the queue shows
AlertInfo
| where Timestamp > ago(7d)
| summarize Alerts = count() by ServiceSource, Severity, Title
| order by Alerts desc
// Behaviors created by Set as behavior rules
BehaviorInfo
| where Timestamp > ago(7d)
| summarize count() by ServiceSource, Title

TODO: confirm whether AlertInfo carries a flag for tuned alerts; Learn names none.

Troubleshoot​

SymptomLikely causeFix
PATCH returns 200 but the queue still shows the old statusPane cached, or the incident was merged and you patched the sourceRefresh. Check redirectIncidentId on the GET; patch the target ID
Incident reopened or reclassified by itselfSentinel bidirectional sync pushed a change from an automation rule or playbookCheck lastModifiedBy and the Sentinel automation rule history
Two obvious duplicates never mergeDifferent owners, different classification or determination, one resolved, or device groups differ with the check onAlign the blocking field, then merge manually, five at a time
Tuning rule saved but alerts keep comingRule scoped to the wrong service or detection source, condition on a value that changes per run, or alert from a custom detection outside the selected detection sourcesOpen the alert, Tune alert from there so scope is pre-filled, use wildcards on volatile paths
Tuning rule with Hide alert refused for an MDO alertHide alert is MDE onlyUse Resolve alert
Set as behavior greyed outAlert is from Defender for Cloud or MDOUse Resolve alert
Phishing Triage Agent skips user reported mailsA built-in or custom rule auto-resolves the Email reported by user as malware or phish alertDisable that built-in rule and any custom rule on the same alert
Notification never arrivesSeverity or device group outside the rule, recipient added after the incident, or sender blocked by mail hygieneSend test email, widen scope, allow the sender
Notification rule cannot be createdAccount lacks Manage security settings, or the device group is outside your RBAC scopeUse Security Administrator or widen the device group assignment
Graph filter returns 400Property not in the filterable listFilter on the seven documented properties, then narrow client side
Graph PATCH returns 403Delegated user lacks Security Operator or Security Administrator, or app lacks SecurityIncident.ReadWrite.AllFix the role or consent
Investigations tab shows zero for an MDO incidentBy designOpen the alert pane for MDO investigations, or the Evidence and Response tab
Sentinel incident shows 150+ alertsCap in the connectorFollow the link to the Defender incident
Alert status changed to Resolved with no analyst actionMDE Automatically resolve alerts after AIR found nothing or remediatedExpected. It never overrides In progress or Resolved set by a person

Gotchas and limits​

  • Classification values changed over time. Legacy API: TruePositive, Clean, InsufficientData. Graph: truePositive, notMalicious, notEnoughDataToValidate. The portal shows a third set of labels. apt and securityPersonnel were removed in August 2022 and sit in the Graph enum as history. Map SIEM and ITSM fields to the Graph names.
  • Alert auto-resolve: the only documented mechanism is the MDE advanced feature that resolves alerts when AIR finds nothing or remediated everything, and it moves device risk level. TODO: no Learn page fetched here says alerts resolve after a fixed number of days; verify before telling a client that.
  • Tuning rules versus MDE suppression: alert tuning is the current surface and Hide alert is the only action limited to MDE. TODO: Learn says nothing here about migrating older MDE suppression rules; check how they show on the Alert tuning page.
  • Hidden alerts are not deleted. They stay in AlertInfo and AlertEvidence, so hunting and reporting still count them.
  • Built-in tuning rules ship on by default: 12 low priority MDO rules from 5 February 2026, DLP alerts as behaviors from 12 October 2026, MDE rules in preview. Review Settings > Microsoft Defender XDR > Rules > Alert tuning after each message center notice.
  • Detection source scoping takes effect 8 November 2026. Untouched rules keep applying to every detection source under their service source, custom detections included.
  • A renamed incident loses its custom name when another incident merges into it. Incident description is not stored in the activity log or Advanced hunting.
  • The legacy experience sits under a preview banner for incident cases. Expect the queue and Manage incident pane to move; the Graph contract is the stable part.

Further reading​

My notes​

TODO: Sohail's notes after verification.

Changelog​

DateChangeSource
2026-10-22Drafted from Learn, with Learn images and diagrams[1]