Respond to alerts and incidents in Microsoft Defender XDR

• Email remediation can require a separate approver
• Soft deletion preserves a recovery path for removed messages
• A completed email remediation can still contain failed items
• Mailbox recovery must inspect attacker-created message-handling rules
• An email-led attack can trigger containment of identities and devices
• Office 365 AIR expands from evidence and does not always wait for manual approval
• Office 365 AIR depends on Plan 2, auditing, and eligible alert triggers
• Threat Explorer supports investigations beyond malicious delivery-time detections
• Latest delivery location tracks security handling rather than every user mailbox action
• Primary override source identifies the override that determined message handling
• URL click actions distinguish enforced blocks from user overrides
• Explorer filters use alternative property values and a shared condition operator
• Message preview requires content authority beyond email metadata access
• Content malware exposes collaboration-file threats outside mailboxes
• Tracking a saved Explorer query enables periodic background investigation
• A legacy incident's empty Investigations tab does not establish that Office 365 AIR never ran
• An insider-risk case groups alerts for one user
• Insider-risk investigations protect user identities by default
• Administrative-unit scope limits which insider-risk cases an investigator can own
• An insider-risk case can be escalated for deeper eDiscovery investigation
• Resolving an insider-risk case classifies all alerts currently in the case
• Needs review alerts require contextual triage before escalation or dismissal
• Insider-risk evidence views distinguish activity chronology from associated content
• Forensic evidence clips help distinguish risky behavior from activity taken out of context
• A workload alert must be investigated against the affected resource's evidence
• Immediate threat mitigation and preventive hardening are separate response steps
• A Defender for Cloud alert can launch an automated response directly
• Suppression is appropriate for recurring verified-benign workload alerts
• Agentless findings may remain after an agent-based threat has been remediated
• Dismissed records the completion of a workload alert response
• Cloud app governance actions depend on the connected application's capabilities
• Remove external users preserves a different access scope than Make private
• Directory synchronization can reverse a cloud app user suspension
• Confirm user compromised raises identity risk for downstream policy enforcement
• Overlapping governance policies do not always resolve by policy order
• Successful MFA can remediate an eligible risky sign-in
• Secure password change for user risk requires MFA first
• Resetting a risky user's password requires password-management authority
• An MFA claim does not automatically clear token-theft detections
• Attacker-registered authentication methods must be removed during identity recovery
• Risk reports require behavioral corroboration before an identity verdict
• Password-spray and leaked-credential detections require credential-exposure triage
• Verified travel or sanctioned VPN use can explain an atypical-travel detection
• Identity risk disposition records the investigation rather than replacing recovery
• Active attacker access calls for blocking and session revocation alongside password recovery
• On-premises password changes clear hybrid user risk only with the required opt-in
• A high-confidence built-in block is identified by its sign-in failure reason
• Identity alert stories distinguish chronology from entity relationships
• Classic identity alert exports include the supporting sensor activities
• Identity entity attributes and learned behavior are different evidence sets
• Identity alert comments and history preserve investigation context for the team
• Disabling an Active Directory user is enforced through identity remediation
• Authorized detected activity is a benign true positive rather than a false positive
• Identity alert discovery must include both Identity and XDR sources
• Identity alert assignment and status track responsibility and investigation progress
• An analytics-rule query is a direct pivot from an incident to its underlying results
• Go hunt can expand an incident investigation beyond its currently attached alerts
• Relevant hunting evidence can be attached to the incident under investigation
• The user-anomaly investigation pivot depends on Sentinel UEBA
• Similar incidents reveal potentially related investigations rather than confirmed duplicates
• Run playbook invokes a response for the investigation already in progress
• Incident entity context must be expanded when an investigation reaches beyond seven days
• The classic investigation graph requires mapped entities and a supported incident age
• Changing alert associations refines an incident's investigation scope
• Sentinel incident comments have different editing and deletion permissions
• The incident timeline reconstructs chronology from both alerts and hunting bookmarks
• Exploration queries extend the classic graph and expose the evidence behind its relationships
• Add to TI promotes an investigated malicious observable into workspace threat intelligence
• Copilot incident summaries condense the attack and its affected assets
• Guided responses and script analysis answer different investigative questions
• Defender Chat can resolve references from the current investigation page
• A proposed multi-step chat investigation waits for analyst approval
• Incident cases can retain the status and outputs of agentic work
• Copilot entity analysis should match the evidence being assessed
• An incident report consolidates response work rather than only the attack overview
• Copilot investigation requires provisioned access and relevant enabled plugins
• Defender Chat history is local to the browser rather than a shared investigation record
• A correlated incident supplies attack context that isolated alerts cannot
• The incident attack graph connects suspicious activity to the assets involved
• Blast radius analysis shows potential propagation paths, not only observed compromise
• An alert's correlation reason helps explain why it belongs to an incident
• Evidence verdict and remediation status answer different questions
• Generic cases track SecOps work that is not generated by incident correlation
• Case tasks make response responsibilities and deadlines explicit
• Managing generic cases needs less privilege than configuring their templates
• Case activity can be audited in the SecurityCaseEvent table
• Incident-case access does not grant every workload response action
• Case-level tracking establishes overall ownership and response priority
• Case management belongs in Defender and requires a workspace only for dependent scenarios
• Built-in tuning can route DLP signals to behaviors instead of incidents
• Reading a DLP alert does not automatically authorize reading its sensitive content
• Unshare is a direct response to an exposed SharePoint or OneDrive item
• DLP investigations can pivot into audit activity through CloudAppEvents
• A DLP match and the associated egress event provide complementary evidence
• A DLP Rule Undo event can result from content or policy changes

Unlock with Premium — includes all practice exams and the complete study guide.