How the Defender XDR incident queue works and how to run it, incident versus alert, severity, status, classification and determination values, tags and assignment, the attack story graph, evidence and response, alert tuning rules, automated investigation verdicts, the Action center, email notifications, the Graph incidents API and the Sentinel handoff.
What Microsoft Secure Score measures and how points are awarded, how Security Exposure Management builds attack paths, critical assets and initiatives on top of MDE, MDVM, MDI, MDA, Entra and Defender for Cloud signals, how Threat analytics maps a tracked threat to your exposure, and how to turn the three into a prioritised work list for a client.
Defender XDR as the correlation layer above MDE, MDI, MDO, MDA, Defender for Cloud and Entra ID Protection, how alerts become incidents, what attack disruption does, the shared hunting schema, Action center, Threat analytics, Secure Score, Exposure Management, licensing, and where Sentinel fits.