Daily Defender News
Aboutmerill.net
Microsoft Unified SecOps Platform
Incidents and response

Plan an incident response workflow in the Microsoft Defender portal

4 September 2026Doc update+7 / −7 lines

In brief

Updated punctuation, list formatting, wording, role-based guidance formatting, and the link text for alert correlation and incident merging documentation.

What Defender admins need to know

Administrators and responders get clearer, more consistent incident response guidance and navigation.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Plan an incident response workflow in the Microsoft Defender portal

In the Microsoft Defender portal, you can respond to security incidents that are collections of related alerts and tell the full story of an attack.

This article provides a set of steps that you can follow to investigate, analyze, and resolve security incidents in the Microsoft Defender portal, and also maps these steps to your security team's experience level and role.

Stage Steps
For each incident, begin an attack and alert investigation and analysis. - View the attack story of the incident to understand its scope, severity, detection source, and which asset entities are affected.
- Begin analyzing the alerts to understand their origin, scope, and severity with the alert story within the incident.
- As needed, gather information on impacted devices, users, and mailboxes with the graph. Select any entity to open a flyout with all the details. Follow through to the entity page for more insights.
- See how Microsoft Defender XDR has resolved alerts through automatic investigation and remediation with the Investigations tab.
- As needed, use information in the data set for the incident for more information with the Evidence and Response tab.
After or during your analysis, perform containment to reduce any additional impact of the attack and eradication of the security threat. For example:
- Disable compromised users
- Isolate impacted devices
- Block hostile IP addresses.addresses
As much as possible, recover from the attack by restoring your tenant resources to the state they were in before the incident. For example:
- Restore affected resources from backups.backups
- Manually restore previous configurations.configurations
Resolve the incident and document your findings. Take time for post-incident learning to:
- Understand the type of the attack and its impact.
- Research the attack in Threat Analytics and the security community for a security attack trend.
- Recall the workflow you used to resolve the incident and update your standard workflows, processes, policies, and playbooks as needed.
- Determine whether changes in your security configuration are needed and implement them.

If you're new to security analysis, seeread the introduction to responding to your first incident for additional information and to step through an example incident.

For more information about incident response across Microsoft products, see incident response overview.

Level Steps
New - See the Respond to your first incident walkthrough to get a guided tour of a typical process of analysis, remediation, and post-incident review in the Microsoft Defender portal with an example attack.
- See which incidents should be prioritized in the incident queue based on severity and other factors.
- Manage incidents, which includes renaming, assigning, classifying, and adding tags and comments based on your incident management workflow.
Experienced - Get started with the incident queue from the Incidents page of the Microsoft Defender portal. From the Incidents page, you can:
- See which incidents should be prioritized in the incident queue based on severity and other factors.
- Manage incidents, which includes renaming, assigning, classifying, and adding tags and comments based on your incident management workflow.
- Investigate incidents.
- Track and respond to emerging threats with threat analytics.
- Proactively hunt for threats with advanced threat hunting.
- See the incident response playbooks for detailed guidance for phishing, password spray, and app consent grant attacks.

Define tasks by security team role

Role Steps
Incident responder (Tier 1) Get started with the incident queue from the Incidents page of the Microsoft Defender portal. From the Incidents page, you can:
- See which incidents should be prioritized in the incident queue based on severity and other factors.
- Manage incidents, which includes renaming, assigning, classifying, and adding tags and comments based on your incident management workflow.
Security investigator or analyst (Tier 2) - Perform investigations of incidents from the Incidents page of the Microsoft Defender portal.
- See the incident response playbooks for detailed guidance for phishing, password spray, and app consent grant attacks.
Advanced security analyst or threat hunter (Tier 3) - Perform investigations of incidents from the Incidents page of the Microsoft Defender portal.
- Track and respond to emerging threats with threat analytics.
- Proactively hunt for threats with advanced threat hunting.
- See the incident response playbooks for detailed guidance for phishing, password spray, and app consent grant attacks.
SOC manager See how to integrate Microsoft Defender XDR into your Security Operations Center (SOC).

Related content

To learn more about alert correlation and incident merging in the Defender portal, see Alert correlation and incident merging in the Microsoft Defender portal.