Microsoft Sentinel Incident Investigation and Incident Management

After you connected your data sources to Microsoft Sentinel, you want to be notified when something suspicious happens. To enable you to do this, Microsoft Sentinel lets you create advanced analytics rules that generate incidents that you can assign and investigate.
Investigate incidents
Use the investigation graph
An incident can include multiple alerts. It's an aggregation of all the relevant evidence for a specific investigation. An incident is created based on analytics rules that you created in the Analytics page. The properties related to the alerts, such as severity and status, are set at the incident level. After you let Microsoft Sentinel know what kinds of threats you're looking for and how to find them, you can monitor detected threats by investigating incidents.
learn.microsof...
learn.microsof...

[@haricharantg5274]

very Understandable video so far

[@whiteeyesecuritytherealtec6623]

Thanks!

[@frezerdugasa7937]

I really appreciate your work, Bro. I could not thank you enough for your video. You really make it Very simple and easy to understand.
I just want to wish you all success and achievements.
Keep Up!! The good work.
Thanks☺

[@whiteeyesecuritytherealtec6623]

You are most welcome

[@ravbhuva]

How do you block, Sandbox, or Isolate devices or Networks?

[@user-dq4yw5dn9t]

thank you

[@whiteeyesecuritytherealtec6623]

You're welcome

[@Cybergazi007]

Awesome video
Thank bro

[@whiteeyesecuritytherealtec6623]

Glad you liked it

[@MrVinay-xj2ug]

Superb 👌👌👌

[@whiteeyesecuritytherealtec6623]

Thanks 🤗

[@chintallakavitha5279]

Awesome

[@user-mw3kw1fq2y]

How to Identify the Incident is a "True Positive or false Positive" and can you explain one true positive case Incident. It will helpfull

[@whiteeyesecuritytherealtec6623]

Basically if it is related to some Malicious activities or there are some malicious Entities Like IP, URL, DNS, etc. You can treat that as a True positive.
False positive is something which have Inaccurate or incomplete data.

[@naxeltechnologies4700]

Amazing

[@whiteeyesecuritytherealtec6623]

Thank you! Cheers!

[@haseebmohd6063]

Hi , how do we reach you

[@whiteeyesecuritytherealtec6623]

Please email me at "[e-mail]". Thank You.

[@martinbaran7570]

not great