Microsoft Defender XDR
GeneralInvestigate Incidents
In brief
The article was updated to describe the Similar incidents page, including the Similarity reason column, which shows shared alerts and entities when hovered over.
What Defender admins need to know
Investigators can use the additional context to understand related incidents, review prior handling, and identify recurring patterns.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- m365-security
- tier1
ms.topic: article
ms.date: 2026-
09-09T00:11-04T00:00:00.0000000Z ai-usage: ai-assisted ms.custom: sfi-image-nochange locale: en-us
Similar incidents
Some incidents might have similar incidents listed onUse the Similar incidents page. This section shows incidents that have similar alerts, entities, and other properties. This similarity can help you understand the scope of the attack and identifypage to view other incidents that might be related.resemble the current incident based on similar alerts or entities. These incidents provide a larger context to help direct your investigation. You can review how similar incidents were handled or look for recurring patterns.
The Similarity reason column shows why each incident appears in the list. Hover over the similarity reason to see the shared alerts and entities.
@@ -17,7 +17,7 @@ ms.collection: - m365-security - tier1 ms.topic: article-ms.date: 2026-09-09T00:00:00.0000000Z+ms.date: 2026-11-04T00:00:00.0000000Z ai-usage: ai-assisted ms.custom: sfi-image-nochange locale: en-us@@ -368,7 +368,9 @@ The information is organized into these sections.
## Similar incidents
-Some incidents might have similar incidents listed on the **Similar incidents** page. This section shows incidents that have similar alerts, entities, and other properties. This similarity can help you understand the scope of the attack and identify other incidents that might be related.
+Use the **Similar incidents** page to view other incidents that resemble the current incident based on similar alerts or entities. These incidents provide a larger context to help direct your investigation. You can review how similar incidents were handled or look for recurring patterns.
+
+The **Similarity reason** column shows why each incident appears in the list. Hover over the similarity reason to see the shared alerts and entities.
[](media/investigate-incidents/incident-similartab.png#lightbox)