Details and results of an automated investigation

Article
09/27/2022

Note

Want to experience Microsoft Defender XDR? Learn more about how you can evaluate and pilot Microsoft Defender XDR.

Applies to:

Microsoft Defender XDR

With Microsoft Defender XDR, when an automated investigation runs, details about that investigation are available both during and after the automated investigation process. If you have the necessary permissions, you can view those details in an investigation details view that provides you with up-to-date status and the ability to approve any pending actions.

(NEW) Unified investigation page

The investigation page has recently been updated to include information across your devices, email, and collaboration content. The new, unified investigation page defines a common language and provides a unified experience for automatic investigations across Microsoft Defender for Endpoint and Microsoft Defender for Office 365. To access the unified investigation page, select the link in the yellow banner you'll see on:

Any investigation page in the Microsoft Purview compliance portal
Any investigation page in the Microsoft Defender portal (https://security.microsoft.com)
Any incident or Action center experience in the Microsoft Defender portal

Open the investigation details view

You can open the investigation details view by using one of the following methods:

Select an item in the Action center
Select an investigation from an incident details page

Select an item in the Action center

The improved Action center (https://security.microsoft.com/action-center) brings together remediation actions across your devices, email & collaboration content, and identities. Listed actions include remediation actions that were taken automatically or manually. In the Action center, you can view actions that are awaiting approval and actions that were already approved or completed. You can also navigate to more details, such as an investigation page.

Tip

You must have certain permissions to approve, reject, or undo actions.

Go to Microsoft Defender portal and sign in.
In the navigation pane, choose Action center.
On either the Pending or History tab, select an item. Its flyout pane opens.
Review the information in the flyout pane, and then take one of the following steps:
- Select Open investigation page to view more details about the investigation.
- Select Approve to initiate a pending action.
- Select Reject to prevent a pending action from being taken.
- Select Go hunt to go into Advanced hunting.

Open an investigation from an incident details page

Use an incident details page to view detailed information about an incident, including alerts that were triggered information about any affected devices, user accounts, or mailboxes.

Go to Microsoft Defender portal and sign in.
In the navigation pane, choose Incidents & alerts > Incidents.
Select an item in the list, and then choose Open incident page.
Select the Investigations tab, and then select an investigation in the list. Its flyout pane opens.
Select Open investigation page.

Here's an example.

Investigation details

Use the investigation details view to see past, current, and pending activity pertaining to an investigation. Here's an example.

In the Investigation details view, you can see information on the Investigation graph, Alerts, Devices, Identities, Key findings, Entities, Log, and Pending actions tabs, described in the following table.

Note

The specific tabs you see in an investigation details page depends on what your subscription includes. For example, if your subscription does not include Microsoft Defender for Office 365 Plan 2, you won't see a Mailboxes tab.

Tab	Description
Investigation graph	Provides a visual representation of the investigation. Depicts entities and lists threats found, along with alerts and whether any actions are awaiting approval. You can select an item on the graph to view more details. For example, selecting the Evidence icon takes you to the Evidence tab, where you can see detected entities and their verdicts.
Alerts	Lists alerts associated with the investigation. Alerts can come from threat protection features on a user's device, in Office apps, Microsoft Defender for Cloud Apps, and other Microsoft Defender XDR features. If you see Unsupported alert type, it means that automated investigation capabilities cannot pick up that alert to run an automated investigation. However, you can investigate these alerts manually.
Devices	Lists devices included in the investigation along with their remediation level. (Remediation levels correspond to the automation level for device groups.)
Mailboxes	Lists mailboxes that are impacted by detected threats.
Users	Lists user accounts that are impacted by detected threats.
Evidence	Lists pieces of evidence raised by alerts or investigations. Includes verdicts (Malicious, Suspicious, Unknown, or No threats found) and remediation status.
Entities	Provides details about each analyzed entity, including a verdict for each entity type (Malicious, Suspicious, or No threats found).
Log	Provides a chronological, detailed view of all the investigation actions taken after an alert was triggered.
Pending actions history	Lists items that require approval to proceed. Go to the Action center (https://security.microsoft.com/action-center) to approve pending actions.

Investigation states

The following table lists investigation states and what they indicate.

Investigation state	Definition
Benign	Artifacts were investigated and a determination was made that no threats were found.
PendingResource	An automated investigation is paused because either a remediation action is pending approval, or the device on which an artifact was found is temporarily unavailable.
UnsupportedAlertType	An automated investigation is not available for this type of alert. Further investigation can be done manually, by using advanced hunting.
Failed	At least one investigation analyzer ran into a problem where it couldn't complete the investigation. If an investigation fails after remediation actions were approved, the remediation actions might still have succeeded.
Successfully remediated	An automated investigation completed, and all remediation actions were completed or approved.

To provide more context about how investigation states show up, the following table lists alerts and their corresponding automated investigation state. This table is included as an example of what a security operations team might see in the Microsoft Defender portal.

Alert name	Severity	Investigation state	Status	Category
Malware was detected in a wim disk image file	Informational	Benign	Resolved	Malware
Malware was detected in a rar archive file	Informational	PendingResource	New	Malware
Malware was detected in a rar archive file	Informational	UnsupportedAlertType	New	Malware
Malware was detected in a rar archive file	Informational	UnsupportedAlertType	New	Malware
Malware was detected in a rar archive file	Informational	UnsupportedAlertType	New	Malware
Malware was detected in a zip archive file	Informational	PendingResource	New	Malware
Malware was detected in a zip archive file	Informational	PendingResource	New	Malware
Malware was detected in a zip archive file	Informational	PendingResource	New	Malware
Malware was detected in a zip archive file	Informational	PendingResource	New	Malware
Wpakill hacktool was prevented	Low	Failed	New	Malware
GendowsBatch hacktool was prevented	Low	Failed	New	Malware
Keygen hacktool was prevented	Low	Failed	New	Malware
Malware was detected in a zip archive file	Informational	PendingResource	New	Malware
Malware was detected in a rar archive file	Informational	PendingResource	New	Malware
Malware was detected in a rar archive file	Informational	PendingResource	New	Malware
Malware was detected in a zip archive file	Informational	PendingResource	New	Malware
Malware was detected in a rar archive file	Informational	PendingResource	New	Malware
Malware was detected in a rar archive file	Informational	PendingResource	New	Malware
Malware was detected in an iso disc image file	Informational	PendingResource	New	Malware
Malware was detected in an iso disc image file	Informational	PendingResource	New	Malware
Malware was detected in a pst outlook data file	Informational	UnsupportedAlertType	New	Malware
Malware was detected in a pst outlook data file	Informational	UnsupportedAlertType	New	Malware
MediaGet detected	Medium	PartiallyInvestigated	New	Malware
TrojanEmailFile	Medium	SuccessfullyRemediated	Resolved	Malware
CustomEnterpriseBlock malware was prevented	Informational	SuccessfullyRemediated	Resolved	Malware
An active CustomEnterpriseBlock malware was blocked	Low	SuccessfullyRemediated	Resolved	Malware
An active CustomEnterpriseBlock malware was blocked	Low	SuccessfullyRemediated	Resolved	Malware
An active CustomEnterpriseBlock malware was blocked	Low	SuccessfullyRemediated	Resolved	Malware
TrojanEmailFile	Medium	Benign	Resolved	Malware
CustomEnterpriseBlock malware was prevented	Informational	UnsupportedAlertType	New	Malware
CustomEnterpriseBlock malware was prevented	Informational	SuccessfullyRemediated	Resolved	Malware
TrojanEmailFile	Medium	SuccessfullyRemediated	Resolved	Malware
TrojanEmailFile	Medium	Benign	Resolved	Malware
An active CustomEnterpriseBlock malware was blocked	Low	PendingResource	New	Malware

Next steps

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.