Incident response with Microsoft 365 Defender
The improved Microsoft 365 security center is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 security center. Learn what's new.
- Microsoft 365 Defender
An incident in Microsoft 365 Defender is a collection of correlated alerts and associated data that make up the story of an attack.
Microsoft 365 services and apps create alerts when they detect a suspicious or malicious event or activity. Individual alerts provide valuable clues about a completed or ongoing attack. However, attacks typically employ various techniques against different types of entities, such as devices, users, and mailboxes. The result is multiple alerts for multiple entities in your tenant.
Because piecing the individual alerts together to gain insight into an attack can be challenging and time-consuming, Microsoft 365 Defender automatically aggregates the alerts and their associated information into an incident.
Watch this short overview of incidents in Microsoft 365 Defender (4 minutes).
Grouping related alerts into an incident gives you a comprehensive view of an attack. For example, you can see:
- Where the attack started.
- What tactics were used.
- How far the attack has gone into your tenant.
- The scope of the attack, such as how many devices, users, and mailboxes were impacted.
- All of the data associated with the attack.
If enabled, Microsoft 365 Defender can automatically investigate and resolve alerts through automation and artificial intelligence. You can also perform additional remediation steps to resolve the attack.
Incidents and alerts in the Microsoft 365 Defender portal
You manage incidents from Incidents & alerts > Incidents on the quick launch of the Microsoft 365 Defender portal (security.microsoft.com). Here's an example.
Selecting an incident name displays a summary of the incident and provides access to tabs with additional information.
The additional tabs for an incident are:
All the alerts related to the incident and their information.
All the devices that have been identified to be part of or related to the incident.
All the users that have been identified to be part of or related to the incident.
All the mailboxes that have been identified to be part of or related to the incident.
All the automated investigations triggered by alerts in the incident.
Evidence and Response
All the supported events and suspicious entities in the alerts in the incident.
A visual representation of the attack that connects the different suspicious entities that are part of the attack with their related assets such as users, devices, and mailboxes.
Here's the relationship between an incident and its data and the tabs of an incident in the Microsoft 365 Defender portal.
Example incident response workflow for Microsoft 365 Defender
Here's an example workflow for responding to incidents in Microsoft 365 with the Microsoft 365 Defender portal.
On an ongoing basis, identify the highest priority incidents for analysis and resolution in the incident queue and get them ready for response. This is a combination of:
- Triaging to determining the highest priority incidents through filtering and sorting of the incident queue.
- Managing incidents by modifying their title, assigning them to an analyst, and adding tags and comments.
For each incident, begin an attack and alert investigation and analysis:
View the summary of the incident to understand it's scope and severity and what entities are affected with the Summary and Graph (Preview) tabs.
Begin analyzing the alerts to understand their origin, scope, and severity with the Alerts tab.
As needed, gather information on impacted devices, users, and mailboxes with the Devices, Users, and Mailboxes tabs.
See how Microsoft 365 Defender has automatically resolved some alerts with the Investigations tab.
As needed, use information in the data set for the incident for more information with the Evidence and Response tab.
After or during your analysis, perform containment to reduce any additional impact of the attack and eradication of the security threat.
As much as possible, recover from the attack by restoring your tenant resources to the state they were in before the incident.
Resolve the incident and take time for post-incident learning to:
- Understand the type of the attack and its impact.
- Research the attack in Threat Analytics and the security community for a security attack trend.
- Recall the workflow you used to resolve the incident and update your standard workflows, processes, policies, and playbooks as needed.
- Determine whether changes in your security configuration are needed and implement them.
If you are new to security analysis, see the introduction to responding to your first incident for additional information and to step through an example incident.
For more information about incident response across Microsoft products, see this article.
Example security operations for Microsoft 365 Defender
Here's an example of security operations (SecOps) for Microsoft 365 Defender.
Daily tasks can include:
- Managing incidents
- Reviewing automated investigation and response (AIR) actions in the Action center
- Reviewing the latest Threat Analytics
- Responding to incidents
Monthly tasks can include:
- Reviewing AIR settings
- Reviewing Secure Score and Threat & Vulnerability Management
- Reporting to your IT security management chain
Quarterly tasks can include a report and briefing of security results to the Chief Information Security Officer (CISO).
Annual tasks can include conducting a major incident or breach exercise to test your staff, systems, and processes.
Daily, monthly, quarterly, and annual tasks can be used to update or refine processes, policies, and security configurations.
See Integrating Microsoft 365 Defender into your security operations for more details.
SecOps resources across Microsoft products
For more information about SecOps across Microsoft's products, see these resources:
Use the listed steps based on your experience level or role on your security team.
Follow this table for your level of experience with security analysis and incident response.
Security team role
Follow this table based on your security team role.
|Incident responder (Tier 1)||Get started with the incident queue from the Incidents page of the Microsoft 365 Defender portal. From here you can:|
|Security investigator or analyst (Tier 2)|
|Advanced security analyst or threat hunter (Tier 3)||
|SOC manager||See how to integrate Microsoft 365 Defender into your Security Operations Center (SOC).|