Question

As a SOC analyst working in the Microsoft Defender portal, you are triaging three separate incidents that appeared within a 15-minute window. All three reference the same compromised user account and originating IP, but each was raised by a different service (Defender for Office 365, Defender for Identity, and Defender for Cloud Apps). You confirm they are stages of the same attack. To streamline investigation and ensure a single, unified attack story with correlated evidence, which action should you take?

Accepted Answer

Merge the three incidents into one incident from the Incidents queue so their alerts and entities are consolidated.

Answer

Resolve two of the incidents as duplicates and continue investigating only the remaining one.

Answer

Create an alert suppression rule so future alerts from these services are grouped automatically.

Answer

Assign all three incidents to the same analyst so they can be worked in parallel.