Investigate and respond using Microsoft 365 Defender in a pilot environment

Applies to:

  • Microsoft 365 Defender

This article outlines the process to create incidents with attack simulations and tutorials and use Microsoft 365 Defender to investigate and respond. Before starting this process, be sure you've reviewed the overall process for evaluating Microsoft 365 Defender and you have created the Microsoft 365 Defender evaluation environment.

Use the following steps.

Steps for performing simulated incident response in the Microsoft 365 Defender evaluation environment.

The following table describes the steps in the illustration.

Step Description
1 Simulate attacks Simulate attacks on your evaluation environment and use the Microsoft 365 Defender portal to perform incident response.
2 Try incident response capabilities Try features and capabilities in Microsoft 365 Defender.

Create the Microsoft 365 Defender Evaluation Environment