Question

A SOC analyst finishes investigating a multi-alert incident in the Microsoft Defender portal that was triggered by a user knowingly running an internal penetration-testing tool. The analyst needs to close the incident so that Defender XDR's machine-learning models improve future detection accuracy and so reporting reflects that no real threat occurred. Which action best accomplishes this?

Accepted Answer

Set the incident status to Resolved and set Classification to 'Informational, expected activity' with a determination of 'Security testing'.

Answer

Set the incident status to Resolved and set Classification to 'True positive' with a determination of 'Security testing'.

Answer

Set the incident status to Resolved and set Classification to 'False positive' with a determination of 'Not malicious'.

Answer

Leave the incident status as In progress and add a custom tag named 'PenTest' without setting a classification.