Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Investigate Incidents with Microsoft Sentinel (legacy)

4 September 2026Doc update+30 / −41 lines

In brief

The page received wording and punctuation edits, updated metadata, clearer similarity-section headings, and new navigation anchors.

What Defender admins need to know

No administrator action is indicated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

This article helps you use Microsoft Sentinel's legacy incident investigation experience. If you're using the newer version of the interface, see Navigate and investigate incidents in Microsoft Sentinel for instructions that match that experience.

After connecting your data sources to Microsoft Sentinel, you want to be notified when something suspicious happens. To enable you to do this,receive these notifications, Microsoft Sentinel lets you create advanced analytics rules that generate incidents that you can assign and investigate.

An incident can include multiple alerts. It's an aggregation of all the relevant evidence for a specific investigation. An incident is created based on analytics rules that you created in the Analytics page. The properties related to the alerts, such as severity and status, are set at the incident level. After you let Microsoft Sentinel know what kinds of threats you're looking for and how to find them, you can monitor detected threats by investigating incidents.

Prerequisites

  1. You can filter the incidents as needed, for example by status or severity. For more information, see Search for incidents.

  2. To begin an investigation, select a specific incident. On the right, you can see detailed information for the incident including its severity, summary of the number of entities involved, the raw events that triggered this incident, the incident’incident's unique ID, and any mapped MITRE ATT&CK tactics or techniques.

  3. To view more details about the alerts and entities in the incident, select View full details in the incident page and review the relevant tabs that summarize the incident information.

    • In the Bookmarks tab, you see any bookmarks you or other investigators have linked to this incident. For more information, see Bookmarks in Microsoft Sentinel.

    • In the Entities tab, you can see all the entities that you map data fields to entities as part of the alert rule definition. These are the objects that played a role in the incident, whether they be users, devices, addresses, files, or other supported entity types.

    • Finally, in the Comments tab, you can add your comments on the investigation and view any comments made by other analysts and investigators. For more information, see Comment on incidents.

  4. Select Investigate to view the investigation map.

Use the investigation graph to deep dive

The investigation graph enables analysts to ask the right questions for each investigation. The investigation graph helps you understand the scope, and identify the root cause, of a potential security threat by correlating relevant data with any involved entity. You can dive deeper and investigate any entity presented in the graph by selecting it and choosing between different expansion options.

  1. Select an incident, then select Investigate. This takes you to the investigation graph. The graph provides an illustrative map of the entities directly connected to the alert and each resource connected further.

    Screenshot of the investigation map showing entity relationships and connections in Microsoft Sentinel.

  1. Select an entity to open the Entities pane so you can review information on that entity.

    Screenshot of the Entities pane showing entity details in the investigation map.

:::image type="content" source="media/investigate-cases/similar-incidents.png" alt-text="Screenshot of the Similar incidents tab listing related incidents ranked by similarity to the current incident." lightbox="media/investigate-cases/similar-incidents.png":::

How similarity is calculated

There are three criteria by which similarity is determined:

  • Similar entities: An incident is considered similar to another incident if they both include the same entities. The more entities two incidents have in common, the more similar they're considered to be.

  • Similar rule:rule: An incident is considered similar to another incident if they were both created by the same analytics rule.

  • Similar alert details:details: An incident is considered similar to another incident if they share the same title, product name, and/or custom details.

The reasons an incident appears in the similar incidents list are displayed in the Similarity reason column. Hover over the info icon to show the common items (entities, rule name, or details).

:::image type="content" source="media/investigate-cases/similarity-popup.png" alt-text="Screenshot of pop-up display of similar incident details.":::

SimilarityHow the similarity time frame works

Incident similarity is calculated based on data from the 14 days before the incident's last activity, defined as the end time of the most recent alert in the incident.

Frequently asked questions about incident comments

The followingThese frequently asked questions describe key considerations for using incident comments.

What kinds of input are supported?

Comments support the following types of input:

  • Text:Text: Comments in Microsoft Sentinel support text inputs in plain text, basic HTML, and Markdown. You can also paste copied text, HTML, and Markdown into the comment window.

  • Images:Images: You can insert links to images in comments and the images are displayed inline, but the images must already be hosted in a publicly accessible location such as Dropbox, OneDrive, Google Drive and the like. Images can't be uploaded directly to comments.

Is there a size limit on comments?

Yes. The following limits apply to incident comments:

  • Per comment:comment: A single comment can contain up to 30,000 characters.

  • Per incident:incident: A single incident can contain up to 100 comments.

The following permissions apply to editing and deleting comments:

  • Editing:Editing: Only the author of a comment has permission to edit it.

  • Deleting:Deleting: Only users with the Microsoft Sentinel Contributor role have permission to delete comments. Even the comment's author must have this role in order to delete it.

Close an incident

Once you resolve a particular incident (for example, when your investigation has reached its conclusion), you should set the incident’incident's status to Closed. When you do so, you'll be asked to classify the incident by specifying the reason you're closing it. This step is mandatory. Select Select classification and choose one of the following from the drop-down list:

  • True Positive -: suspicious activity
  • Benign Positive -: suspicious but expected
  • False Positive -: incorrect alert logic
  • False Positive -: incorrect data
  • Undetermined

:::image type="content" source="media/investigate-cases/closing-reasons-dropdown.png" alt-text="Screenshot that highlights the classifications available in the Select classification list.":::

For more information about false positives and benign positives, see Handle false positives in Microsoft Sentinel.

After choosing the appropriate classification, add some descriptive text in the Comment field. Adding a descriptive comment is useful in the event you need to refer back to this incident. Select Apply when you’you're done, and the incident is closed.

:::image type="content" source="media/investigate-cases/closing-reasons-comment-apply.png" alt-text="Screenshot of the incident closing dialog with a classification selected and a descriptive comment added.":::

By default, incident searches run across the Incident ID, Title, Tags, Owner, and Product name values only. In the search pane, scroll down the list to select one or more other parameters to search, and select Apply to update the search parameters. Select Set to default reset the selected parameters to the default option.

Using advanced search options changes the search behavior as follows:

| Cross workspace support | Advanced searches aren't supported for cross-workspace views. | | Number of search results displayed | When you're using advanced search parameters, only 50 results are shown at a time. |

Related content