Summary

In this chapter, you learned about the Microsoft Sentinel Incidents page and its various components. You learned how to view an incident and change its values, including who owns that incident, its severity, and how to close an incident.

You also learned how to view more details about the incident along with the alert(s) that generated it, any bookmarks associated with it, the entities that the incident contains, and all the comments added to it.

Finally, you learned about Microsoft Sentinel's graphical incident investigation feature. This allows you to not only view the incident in question but also the related alerts, the timeline of those alerts, and more information about the entities.

In the next chapter, you will learn about hunting for issues that alerts and incidents may not have found.