11.2 Incidents, Alerts & Advanced Hunting

Quick Answer: A Microsoft Defender XDR incident is a correlated group of alerts across Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Entra ID, presented as one investigation unit. Advanced hunting lets you query up to 30 days of raw event data with Kusto Query Language (KQL) to proactively find threats that alerts missed.

The Incident Model

Microsoft Defender XDR's core value proposition is correlation across workloads. A phishing email that lands in a user's inbox (Defender for Office 365), leads to a suspicious sign-in from a new location (Entra ID), and triggers endpoint behavior on the user's device (Defender for Endpoint) would, in a siloed model, produce three unrelated alerts. Defender XDR correlates them into a single incident so an analyst sees the whole story and responds once, not three times.

Incident Properties

• Severity — Low, Medium, High, or Informational, derived from the underlying alerts and impacted assets.
• Status — New, In progress, or Resolved, tracked in the incident queue.
• Categories — e.g., Impact, Malware, Initial access, Credential access, Exfiltration, mapped to MITRE ATT&CK tactics.
• Impacted assets — devices, users, mailboxes, and apps, with the related alerts grouped under each.
• Owner — the analyst assigned to investigate and resolve.
• Classification — set on resolution: true positive (with a determination such as malware, phishing, or unwanted software), false positive, or informational activity expected.

The Investigation Graph

The investigation graph visualizes the entities (devices, users, IPs, files, emails, apps) and the relationships between them for an incident. It is the fastest way to understand blast radius — which accounts and devices an attacker touched — and to choose which response actions to apply first.

Responding to Incidents

From an incident (or an individual alert), an administrator can take workload-specific response actions without leaving the Defender portal:

Incident Workflow

1. Triage — review the incident queue, sort by severity or impacted business-critical asset, and decide what to act on first.
2. Assign — set an owner so accountability is clear.
3. Investigate — read the alert story, open the investigation graph, and review the evidence per entity.
4. Respond — apply the appropriate response actions from the table above.
5. Classify and resolve — mark as true positive (with a determination) or false positive, set status to Resolved, and add notes for the post-incident review.

Advanced Hunting

Advanced hunting is a query-based threat-hunting tool in the Microsoft Defender portal. It exposes up to 30 days of raw event data from Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Entra ID using Kusto Query Language (KQL) — the same query language used by Azure Data Explorer and Microsoft Sentinel.

The Schema (conceptually)

Advanced hunting organizes data into tables by domain. You do not need to memorize every column for the exam, but you should recognize the major tables:

A Simple Example Query

The query below finds processes launched by Office applications on endpoints in the last 7 days — a classic macro-execution pattern worth reviewing:

DeviceProcessEvents
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe")
| where Timestamp > ago(7d)
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName
| order by Timestamp desc

This is illustrative only — you are not expected to write KQL on the exam — but you should be able to read it at a conceptual level: filter the DeviceProcessEvents table to rows where the initiating process is an Office app, restrict to the last 7 days, project the interesting columns, and sort newest first.

Shared and Custom Queries

The advanced hunting experience ships with shared queries curated by Microsoft and the community, and lets you save custom queries for your tenant. From a query result you can take supported actions directly on matched entities — for example, initiate an antimalware scan on a device, add an indicator to Defender for Endpoint, or open an entity's page for deeper investigation.

How Incidents and Advanced Hunting Connect

A common workflow is to start from an incident's indicators (a file hash, a sender address, an IP), pivot into advanced hunting with a query that searches the whole tenant for those same indicators across the last 30 days, and then — if you find more impacted assets — add them to the incident or open a new one. This is the essence of "review and respond" at the MS-102 level.