Contoso Legal LLP
Defender groups related alerts into an incident, so one attack shows once. Work through these from the most severe: assign each to someone, and close it in Defender with what it turned out to be.
| Incident | Severity | Status | Assigned to | Alerts | Created (UTC) | Link |
|---|---|---|---|---|---|---|
| Phishing involving one user high | High | Active | 1 | 14 Oct 2026, 14:48 | Open in Defender | |
| Execution incident on one endpoint medium | Medium | In progress | helpdesk@msp.example | 1 | 12 Oct 2026, 14:48 | Open in Defender |
Alerts nobody has resolved yet. One that's still new and assigned to nobody hasn't been looked at. Check what each names: for an account, its recent sign-ins, inbox rules and MFA methods; for a device, what Defender found on it. Then resolve it in Defender, saying whether it was a real threat.
| Alert | Severity | Status | Picked up | Source | Accounts | Devices | Created (UTC) | Link |
|---|---|---|---|---|---|---|---|---|
| Email messages containing malicious URL removed after delivery high | High | New | No | Defender for Office 365 | annabel.fraser@ | 14 Oct 2026, 14:48 | Open in Defender | |
| Suspicious PowerShell command line medium | Medium | In progress | Yes | Defender for Endpoint | LAPTOP-MARSH\bob | LAPTOP-MARSH | 12 Oct 2026, 14:48 | Open in Defender |
| Unfamiliar sign-in properties low | Low | New | No | Entra ID Protection | carl.ashworth@contoso.example | 15 Oct 2026, 14:48 | Open in Defender | |
| eDiscovery search started or exported | Informational | New | No | Defender XDR | 13 Oct 2026, 14:48 | Open in Defender |
Alerts resolved in the last 30 days, and what whoever closed each said it was.
| Alert | Severity | Source | Outcome | Accounts | Devices | Resolved (UTC) |
|---|---|---|---|---|---|---|
| User clicked a malicious link | High | Defender for Office 365 | Real threat (phishing) | dan.redford@contoso.example | 11 Oct 2026, 14:48 |
From Microsoft Defender's alerts and incidents. Which services report to it depends on the tenant's licences: Defender for Office 365 for email, Defender for Endpoint or Business for computers, Entra ID Protection for sign-ins. Office Sentry keeps the accounts and devices an alert names, never the email, file or command behind it. Times are UTC.
Data from Security alerts ().