Question

A SOC analyst in Microsoft Defender XDR opens a high-severity incident involving a suspected credential-theft attack across two devices and one user. The analyst begins active investigation and wants the incident queue to accurately reflect that work has started but is not yet complete, and to ensure automated investigation results and any newly correlated alerts remain attached to the same incident. Which incident status should the analyst set at this point?

Accepted Answer

Set the incident status to In progress and leave it open.

Answer

Set the incident status to New so other analysts are alerted to pick it up.

Answer

Set the incident status to Resolved with a classification of Informational, expected activity.

Answer

Set the incident status to Resolved with a classification of True positive.