Field notes from years of cyber defense incident response — triage, high-stakes decision making, enterprise-wide coordination, and executive communication — built on Microsoft Defender XDR, Defender for Endpoint, Microsoft Sentinel, and the broader Microsoft security ecosystem.
An Incident Commander (IC) is not the person who reverses the malware or writes the detection — the IC is the person who makes sure the right people do the right things in the right order, fast, while leadership and customers stay accurately informed. Triage is the discipline that makes that possible under pressure.
Triage answers three questions before anything else: scope (what is affected — how many tenants, hosts, identities, services?), urgency (is the attacker active right now? is data actively leaving?), and risk impact (what is the worst realistic outcome for customers and the business?).
Vulnerability triage is a different muscle: no active attacker (yet), but a race against exploitation. The core judgment is exploitability × exposure × blast radius, not just the CVSS number.
Defender XDR is the correlation brain; each workload product is a sensor and a response surface. Knowing exactly which product answers which question is what makes triage fast.
Unified incident queue, cross-domain correlation, attack story timeline, automatic attack disruption, unified Advanced Hunting (KQL) across all workloads.
Device timeline, live response, device isolation, file quarantine, IOC blocking, ASR rules, automated investigation & remediation (AIR).
Detects credential theft, lateral movement paths, DC recon, Kerberos abuse (Golden/Silver ticket), and feeds identity context into every incident.
Phishing/BEC detection, Threat Explorer, ZAP (zero-hour auto purge), attack simulation, campaign views — usually where the initial access story starts.
Shadow IT discovery, OAuth app governance (consent abuse!), session controls, anomalous cloud activity detections.
CSPM + workload protection for Azure/AWS/GCP — VM, container, storage, and key vault alerts; attack path analysis for cloud blast radius.
Log aggregation beyond the Defender family (firewalls, proxies, custom apps), analytics rules, automation playbooks (Logic Apps), workbooks, and long-term hunting.
Risky user/sign-in detections, token protection, and the enforcement plane: revoke sessions, require MFA, block by risk — tenant-wide in minutes.
CVE-to-device mapping, exploit availability signals, exposure score, remediation requests to Intune — the backbone of vulnerability triage.
Actor profiles, infrastructure chaining, IOC reputation; MSRC advisories/CVEs for Microsoft products — the "is this exploited in the wild?" answer.
Incident summarization, guided response, KQL generation from natural language, script deobfuscation — an accelerator for triage and executive reporting.
What data was where: sensitivity labels, DLP events, and Insider Risk signals tell you whether "a compromised host" means "regulated data exposure."
The end-to-end flow I run for a critical incident. Click each step to expand the details, tooling, and example queries.
An incident arrives from one of four doors: Defender XDR / Sentinel automated correlation, a SOC analyst escalation, an external report (MSRC, researcher, customer, partner CERT), or threat-intel-driven proactive hunting. First move: acknowledge, timestamp, and open the incident record.
Time-boxed (15–30 min for anything that smells Sev 0/1). Goal: enough evidence to classify — not root cause. Work the Defender XDR attack story first: correlated alerts, affected assets, MITRE techniques, and automatic attack disruption actions already taken.
DeviceFileEvents
| where SHA256 == "<ioc_hash>"
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
by DeviceId, DeviceName, FileName, FolderPath
| order by FirstSeen asc // patient zero at the topEmailEvents
| where SenderFromAddress == "<attacker>" or Subject has "<campaign_subject>"
| summarize Recipients=dcount(RecipientEmailAddress),
Delivered=countif(DeliveryAction == "Delivered") by Subject, SenderFromAddressThe IC declares severity (see the matrix below) and mobilizes accordingly. Declaring high and downgrading later is cheap; declaring low and upgrading later is expensive.
Containment decisions are the highest-stakes calls of the incident: every action tips off a sophisticated actor and can destroy evidence or break production. The IC weighs speed vs. stealth vs. business impact — explicitly, out loud, on the record.
With containment holding, build the complete narrative: initial access → execution → persistence → privilege escalation → lateral movement → collection → exfiltration/impact. Map every finding to ATT&CK techniques so the story is portable across teams and reports.
CloudAppEvents
| where ActionType in ("New-InboxRule", "Set-InboxRule")
| where RawEventData has_any ("Delete", "MoveToFolder", "ForwardTo")
| project Timestamp, AccountObjectId, ActionType, RawEventData
| order by Timestamp descRuns in parallel with everything above. Executives need risk in business terms, current state, and what you need from them — not packet captures. Use a fixed template so updates are comparable over time.
The highest-scrutiny artifact of the incident. The IC advises and validates — accuracy over speed, but regulatory clocks (e.g., 72h under GDPR, contractual SLAs, sector rules) set the outer bound. Work hand-in-hand with legal, privacy, and comms.
Remove the adversary completely, then restore service — in that order. Partial eradication against a persistent actor means round two, on their schedule.
An incident isn't over when the attacker is gone — it's over when the record is complete. The final report is written for three audiences at once: executives (risk & cost), engineers (technical detail & ATT&CK mapping), and future responders (what to do faster next time).
The step that separates mature programs from busy ones. Blameless review within ~5 business days, then feed the machine: detections, playbooks, and investment recommendations.
Severity drives everything: who gets paged, how often executives hear from you, and what authority the IC can exercise without further approval. Agree on this before the incident.
| Severity | Definition | Examples | Mobilization | Exec Update Cadence |
|---|---|---|---|---|
| SEV 0 | Critical, active, customer-impacting. Confirmed compromise with ongoing customer or business-critical impact. | Active ransomware; confirmed customer data exfiltration; zero-day exploited in the wild against products/customers; domain/tenant compromise. | Full bridge 24/7, all workstreams, leadership engaged, legal/comms activated. | Every 1–2 hours |
| SEV 1 | High. Confirmed compromise, impact contained or not yet customer-facing; or critical vulnerability with public exploit and exposure. | Compromised privileged account (contained); malware on servers without confirmed exfil; KEV-listed CVE on internet-facing estate. | Bridge during business + on-call, named IC, core workstreams. | Every 4–6 hours |
| SEV 2 | Medium. Probable or limited compromise, low blast radius, no sensitive data indicated. | Single compromised standard user (phish, contained); commodity malware on one workstation; suspicious OAuth app removed. | SOC-led with IC oversight, standard hours. | Daily summary |
| SEV 3 | Low. Suspicious activity, unconfirmed, or policy violations without compromise. | Failed attack fully blocked by controls; informational TI match; DLP policy violation. | Standard SOC queue. | Weekly rollup |
Notes accumulated across years of triage, bridges, and 3 a.m. decisions. None of these are theoretical — each one exists because skipping it once hurt.