Alert Triage Playbook

1 Alert Severity Classification

Microsoft Defender for Endpoint assigns severity levels to alerts based on the potential impact and confidence of the detection. The following table defines the SOC triage expectations for each severity tier.

2 MDE Alert Categories

MDE alert categories map directly to threat behaviors. The following table provides the mapping between MDE alert categories and MITRE ATT&CK tactics along with associated technique identifiers for reference during triage.

3 Triage Decision Tree

Follow this structured decision tree for every incoming MDE alert. Each step ensures consistent triage outcomes across the analyst team.

• ALERT RECEIVED — Begin Triage Workflow
  • Step 1: Is the alert a duplicate or known false positive?
    • Close as Duplicate/Known FP. Document the reason in the alert closure notes.
    • Continue to Step 2
      • Step 2: Check alert context in MDE (Review device timeline, alert story, automated investigation results)
        • Step 3: Is the activity from a sanctioned tool/process?
          • Verify with asset inventory/CMDB
            • Confirmed sanctioned: Close as Benign True Positive (BTP). Consider adding a suppression rule.
            • Not in inventory: Escalate for review by senior analyst or tool owner.
          • Continue to Step 4
            • Step 4: Does the alert correlate with known threat intelligence?
              • Escalate as True Positive. Create Incident and assign to IR team.
              • Continue to Step 5
                • Step 5: Run enrichment queries (see Section 6: Enrichment Workflows)
                  • Step 6: Based on enrichment results, classify the alert:
                    • True Positive (TP): Create incident, assign severity, begin incident response procedures.
                    • False Positive (FP): Close alert, document rationale, consider detection tuning.
                    • Benign True Positive (BTP): Close alert, document expected behavior, consider suppression rule.

4 Initial Investigation KQL Queries

The following KQL queries support the triage workflow. Run these in Microsoft 365 Defender Advanced Hunting to gather context around an alert entity.

Device Timeline Around Alert

let alertTime = datetime(2024-01-15T10:30:00Z);
let deviceName = "WORKSTATION-01";
let timeWindow = 30m;
DeviceProcessEvents
| where Timestamp between ((alertTime - timeWindow) .. (alertTime + timeWindow))
| where DeviceName == deviceName
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| sort by Timestamp asc

Alert Process Tree Analysis

AlertEvidence
| where AlertId == "your-alert-id"
| where EntityType == "Process"
| project DeviceId, FileName, ProcessCommandLine, ParentProcessName = InitiatingProcessFileName
| join kind=leftouter (
    DeviceProcessEvents
    | project DeviceId, FileName, ProcessCommandLine, SHA256,
             ParentProcess = InitiatingProcessFileName, ParentCommandLine = InitiatingProcessCommandLine
) on DeviceId, FileName
| project-away DeviceId1, FileName1

Lateral Movement Check for Alert Entity

let suspiciousAccount = "compromised_user";
let timeRange = 24h;
DeviceLogonEvents
| where Timestamp > ago(timeRange)
| where AccountName == suspiciousAccount
| where LogonType in ("RemoteInteractive", "Network", "Batch")
| summarize LogonCount = count(),
            Devices = make_set(DeviceName),
            LogonTypes = make_set(LogonType)
    by AccountName, bin(Timestamp, 1h)
| sort by Timestamp desc

File Hash Prevalence Check

let targetHash = "abc123...";
DeviceFileEvents
| where SHA256 == targetHash
| summarize DeviceCount = dcount(DeviceName),
            Devices = make_set(DeviceName),
            FirstSeen = min(Timestamp),
            LastSeen = max(Timestamp)
| extend PrevalenceAssessment = iff(DeviceCount < 3, "Rare - Investigate",
                                iff(DeviceCount < 10, "Uncommon - Review", "Common - Likely Legitimate"))

Network IOC Fleet-Wide Check

let suspiciousIP = "203.0.113.50";
let suspiciousDomain = "malicious-domain.com";
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP == suspiciousIP or RemoteUrl has suspiciousDomain
| summarize ConnectionCount = count(),
            Devices = make_set(DeviceName),
            Ports = make_set(RemotePort),
            FirstConnection = min(Timestamp),
            LastConnection = max(Timestamp)
    by RemoteIP, RemoteUrl
| sort by ConnectionCount desc

Parent Process Chain Analysis

let targetDevice = "WORKSTATION-01";
let targetProcess = "suspicious.exe";
DeviceProcessEvents
| where DeviceName == targetDevice
| where FileName == targetProcess or InitiatingProcessFileName == targetProcess
| project Timestamp, FileName, ProcessCommandLine,
         Parent = InitiatingProcessFileName,
         ParentCmd = InitiatingProcessCommandLine,
         GrandParent = InitiatingProcessParentFileName
| sort by Timestamp asc

Prior Alerts for Entity

let entityName = "WORKSTATION-01";
AlertInfo
| where Timestamp > ago(30d)
| join kind=inner (
    AlertEvidence
    | where EntityType in ("Machine", "User", "File")
    | where DeviceName == entityName or AccountName == entityName or FileName == entityName
) on AlertId
| summarize AlertCount = count(),
            AlertTitles = make_set(Title),
            Severities = make_set(Severity),
            Categories = make_set(Category)
    by DeviceName, AccountName
| sort by AlertCount desc

5 Evidence Collection Procedures

When an alert is confirmed as a True Positive or requires further investigation, the following evidence must be collected and preserved before any containment actions are taken.

6 Enrichment Workflows

Enrichment adds external and internal context to alert entities (files, IPs, domains, users). Follow this procedure for every alert that progresses past Step 4 in the Triage Decision Tree.

Enrichment Procedure Steps

1. Check file hash on VirusTotal (manual upload or API query). Record detection ratio, first seen date, and any sandbox behavioral reports.
2. Check domain/IP reputation on VirusTotal, AbuseIPDB, and Shodan. Record abuse confidence score, geolocation, ASN, and any associated malware campaigns.
3. Perform WHOIS lookup for suspicious domains. Note registration date, registrar, nameservers, and registrant information. Recently registered domains (<30 days) are high risk.
4. Query internal threat intelligence database/platform. Cross-reference IOCs with any active threat hunts, previous incidents, or known adversary infrastructure tracked by the team.
5. Check Microsoft Threat Intelligence for the entity. Review the MDE file profile, URL reputation, and any associated global alert prevalence data within the Microsoft ecosystem.
6. Verify device compliance status in MDE. Check whether the affected device has missing patches, disabled security features, or policy violations that may have contributed to the alert.
7. Check user risk score in Azure AD Identity Protection. Review sign-in risk events, impossible travel detections, and any existing risk flags on the user account associated with the alert.

Enrichment Decision Matrix

7 Alert Closure Documentation

Every alert must be closed with proper documentation to maintain audit trails, enable metrics reporting, and support detection tuning. The following fields are required or recommended for each alert closure.

Required Closure Fields