Incidents, alerts, investigation and triage
How the Defender XDR incident queue works and how to run it, incident versus alert, severity, status, classification and determination values, tags and assignment, the attack story graph, evidence and response, alert tuning rules, automated investigation verdicts, the Action center, email notifications, the Graph incidents API and the Sentinel handoff.