Learning Path 8 - Lab 1 - Exercise 7 - Investigate Incidents

Lab scenario

You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You already created Scheduled and Microsoft Security Analytics rules. The Fusion and Anomalies Analytics rules are also enabled in your environment. Now is the time to investigate the Incidents created by them.

An incident can include multiple alerts. It is an aggregation of all the relevant evidence for a specific investigation. The properties related to the alerts, such as severity and status, are set at the incident level. After you let Microsoft Sentinel know what kinds of threats you are looking for and how to find them, you can monitor detected threats by investigating incidents.

Important: The lab exercises for Learning Path #8 are in a standalone environment. If you exit the lab before completing it, you will be required to re-run the configurations again.

Estimated time to complete this lab: 30 minutes

Task 1: Investigate an incident

In this task, you will investigate an incident.

Note: Microsoft Sentinel has been predeployed in your Azure subscription with the name Sentinelworkspace-01, and the required Content hub solutions have been installed.

1. Sign in to WIN1 virtual machine as Admin using the provided credentials.

2. Open Microsoft Edge and navigate to Microsoft Defender XDR at https://security.microsoft.com.

3. In the Sign in dialog box, copy, and paste in the Tenant Email account provided by your lab hosting provider and then select Next.

4. In the Enter password dialog box, copy, and paste in the Tenant Password provided by your lab hosting provider and then select Sign in.

   Note: You may be prompted to enter the Temporary Access Pass (TAP) instead of a password. This is also provided in the resources tab. If prompted, copy and paste the TAP value and select Sign in.

5. In the Microsoft Defender navigation menu, scroll down and expand the Investigation & response section.

6. Expand the Incidents & alerts section and select Incidents.

7. Review the list of incidents.

   Note: The Analytics rules are generating alerts and incidents on the same specific log entry. Remember that this was done in the Query scheduling configuration to generate more alerts and incidents to be utilized in the lab.

8. Select one of the Startup RegKey incidents.

9. Review the incident details on the page that opened.

10. Select Manage incident from the toolbar. It will have a pencil icon.

11. On the Manage incident page, in the Incident tags field, type RegKey and select RegKey (Create new).

12. In the Assign to field, select the box and then select Assign to me from the dropdown.

13. Verify the Status is set to Active. If not, change the status to Active.

14. Select Save to apply the changes and close the page.

15. Review the Attack story tab. Select the Run playbook from the toolbar. Hint: You might need to select the ellipsis icon (…) to see it.

16. You will see the PostMessageTeams-OnIncident playbook. This option helps you to run playbooks manually.

17. Close the Run playbook on incident blade by selecting the X icon in the top right.

18. Review the Entities window. At least the Host entity that we mapped within the KQL query from the previous exercise should appear. Hint: If no entities are shown, refresh the page.

19. Select the ellipsis icon (…) from the toolbar, and then select Tasks.

20. Select + Add task, type Review who owns the machine in the Name field and select Save.

21. Close the Incident tasks blade by selecting the x icon in the top right.

22. Select the new Activity Log button from the command bar.

23. Review the actions you have taken during this exercise.

24. Close the Incident activity log blade by selecting the x icon in the top right.

25. From the almost hidden left blade, select the user icon named Unassigned. The new incident experience allows quick changes from here.

26. Select Assign to me and then scroll down to select Apply to save the changes.

27. Expand the left blade by selecting the » icon. and then select the Investigate button.

    Hint: If the icons are too small for your screen, select (+) to magnify them.

28. Hover the WINServer entity icon and wait for new exploration queries to be shown. It looks that Related Alerts has more data on it. Select the name of the exploration query Related Alerts to bring them to the investigation graph or select Events > to investigate them with a KQL query.

29. Close the query window by selecting the X icon at the top right to go back to the Investigation page.

30. Now select the WINServer entity, a window on the right opens for more detailed information. Review the Info page.

31. Select Timeline button. Hover the incidents and see which things on the graph occurred at what point in time.

32. Select Entities button and review the Entities and Alerts related to WINServer.

33. Close the investigation graph by selecting the X icon at the top right of the page.

34. Back in the incident page, in the left pane select Active Status and select Closed.

35. In the Select classification drop-down review the different options. After that, select True positive - suspicious activity and then select Apply.

Proceed to Exercise 8