How to Investigate Incidents in Microsoft Sentinel

Incident investigation is where security operations transforms raw alerts into actionable intelligence. Microsoft Sentinel provides powerful tools to help analysts efficiently triage, investigate, and resolve security incidents. This guide covers the complete investigation workflow from initial triage to case closure.

Prerequisites

Before investigating incidents, ensure you have:

• Microsoft Sentinel Responder role or higher
• Access to the Log Analytics workspace for running queries
• Understanding of your environment (normal vs. suspicious activity)
• Incident response playbook or documented procedures
• Knowledge of entity types and their relationships

Understanding the Incident Queue

Access the Incident Queue

1. In Microsoft Sentinel, go to Threat management > Incidents
2. The queue shows all open incidents sorted by severity and time

Incident Queue Columns

Filter and Sort Incidents

Use filters to focus your queue:

• Status: New (untriaged), Active (in progress)
• Severity: Start with High severity
• Owner: Unassigned incidents need attention
• Time range: Focus on recent incidents first

Step 1: Initial Triage

Triage determines whether an incident requires full investigation or can be quickly resolved.

Quick Triage Checklist

1. Read the incident title and description - What was detected?
2. Review the severity - Is this appropriate for the alert type?
3. Check the entities - Who or what is affected?
4. Look at alert count - Multiple alerts suggest confirmed activity
5. Review timestamps - When did this occur? Is it ongoing?

Open the Incident

1. Click on an incident to open the details panel
2. Review the Overview tab for summary information
3. Scan the Alerts section to understand what triggered the incident

Make an Initial Classification

Step 2: Assign and Document

Assign the Incident

1. Click Manage in the incident panel
2. Under Owner, select yourself or appropriate analyst
3. Set Status to Active
4. Click Apply

Add Initial Comments

Document your initial assessment:

1. Click Comments tab
2. Add your triage notes:
   • Initial observations
   • Hypothesis about what occurred
   • Investigation plan
3. Click Save

Create Investigation Tasks

Use tasks to track investigation steps:

1. Click Tasks tab
2. Click Add task
3. Create tasks for your investigation plan:
   • "Review entity timeline"
   • "Check for related alerts"
   • "Investigate source IP"
   • "Interview affected user"
4. Check tasks off as you complete them

Step 3: Analyze Entities

Entities are the core of investigation - they represent the users, hosts, IPs, and other elements involved in the incident.

View Entity Details

1. Click the Entities tab in the incident
2. Select an entity to view its details
3. Review the entity page for context

Entity Types and Key Information

Run Entity Queries

From the entity page, click View full details to access:

1. Timeline: All activities involving this entity
2. Insights: Automated analysis and anomalies
3. Related alerts: Other incidents involving this entity

Investigation Graph

For visual analysis:

1. Click Investigate button on the incident
2. The investigation graph shows entity relationships
3. Expand entities to see connections
4. Look for patterns connecting multiple entities

Step 4: Reconstruct the Timeline

Understanding the sequence of events is critical for determining scope and impact.

Build a Timeline

1. Go to Logs in Microsoft Sentinel
2. Run timeline queries for involved entities:

// Account activity timeline
let TargetUser = "[email protected]";
union SigninLogs, AuditLogs, SecurityEvent, OfficeActivity
| where TimeGenerated > ago(24h)
| where UserPrincipalName == TargetUser or
        Account contains TargetUser or
        UserId == TargetUser
| project TimeGenerated, Type, Activity = coalesce(OperationName, Activity, EventID)
| order by TimeGenerated asc

// Host activity timeline
let TargetHost = "WORKSTATION01";
SecurityEvent
| where TimeGenerated > ago(24h)
| where Computer contains TargetHost
| where EventID in (4624, 4625, 4688, 4672, 4720, 4722, 4723, 4724, 4725, 4726)
| project TimeGenerated, EventID, Activity, Account, Computer
| order by TimeGenerated asc

Key Timeline Events to Find

Step 5: Expand the Scope

Determine if the incident affects more than the initially detected entities.

Search for Related Activity

Run broad queries to find related events:

// Find all activity from suspicious IP
let SuspiciousIP = "192.168.1.100";
union *
| where TimeGenerated > ago(7d)
| where IPAddress == SuspiciousIP or
        SourceIP == SuspiciousIP or
        ClientIP == SuspiciousIP
| summarize EventCount = count() by Type
| order by EventCount desc

// Find similar attacks across environment
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 50126  // Same failure code
| summarize
    Attempts = count(),
    TargetUsers = dcount(UserPrincipalName)
    by IPAddress
| where Attempts > 10
| order by Attempts desc

Check for Additional Compromised Accounts

// Accounts that signed in from the suspicious IP
SigninLogs
| where TimeGenerated > ago(7d)
| where IPAddress == "suspicious_ip_here"
| where ResultType == 0  // Successful
| distinct UserPrincipalName

Review Neighboring Alerts

1. In the incident, check Related incidents
2. Look for other incidents involving the same entities
3. Consider merging related incidents for unified investigation

Step 6: Collect Evidence

Document findings for reporting and potential legal proceedings.

Bookmark Important Findings

1. Run a query that shows relevant evidence
2. Select the rows to bookmark
3. Click Add bookmark
4. Add tags and notes to the bookmark
5. Bookmarks are preserved even if source logs age out

Export Query Results

1. Run your evidence query
2. Click Export > Export to CSV
3. Save for your incident documentation

Take Screenshots

Capture visual evidence of:

• Investigation graph showing attack path
• Entity timelines
• Key log entries
• Dashboard views showing anomalies

Step 7: Determine Classification

Based on your investigation, classify the incident:

Step 8: Close the Incident

Document Final Findings

1. Add a comprehensive closing comment including:
   • Summary of what occurred
   • Root cause determination
   • Scope of impact
   • Actions taken
   • Recommendations for prevention

Set Classification and Close

1. Click Manage on the incident
2. Set Classification:
   • True Positive - Suspicious Activity
   • Benign Positive - Confirmed Activity
   • False Positive - Incorrect Data
   • False Positive - Incorrect Analytics
   • Undetermined
3. Add Classification reason (required)
4. Set Status to Closed
5. Click Apply

Investigation Best Practices

Common Investigation Pitfalls

Incident Investigation Checklist

Use this checklist for consistent investigations:

• Triage: Reviewed severity, entities, and alert details
• Assigned: Incident assigned to analyst, status set to Active
• Documented: Initial hypothesis and investigation plan noted
• Entities: All entities analyzed and expanded
• Timeline: Complete sequence of events reconstructed
• Scope: Related activity and additional targets identified
• Evidence: Key findings bookmarked and exported
• Classification: True/False positive determination made
• Remediation: Necessary response actions completed or escalated
• Closure: Final documentation added, incident closed

Next Steps

After closing incidents:

1. Review patterns - Look for recurring incident types
2. Tune detection rules - Reduce false positives
3. Update playbooks - Incorporate lessons learned
4. Report metrics - Track MTTD, MTTR, and resolution rates
5. Share knowledge - Brief the team on interesting cases

Additional Resources

• Microsoft Sentinel Investigation Features
• Entity Pages Documentation
• Investigation Graph Tutorial

Need help improving your incident response? Inventive HQ offers SOC optimization services, from playbook development to analyst training. Contact us to strengthen your security operations.