Lesson 30 — End-to-End Incident Investigation
A complete security investigation rarely lives inside one alert or one Microsoft product.
Security Copilot helps analysts summarise incidents, generate KQL, enrich indicators, explain ATT&CK techniques, analyse suspicious files and connect evidence across Defender XDR, Sentinel, Entra, Defender for Cloud and supporting services.
This capstone lesson brings every Module 3 skill into one complete workflow—from the first alert through containment, recovery, executive reporting and lessons learned.
What you will learn
This capstone lesson combines every Module 3 investigation skill into one complete workflow.
End-to-end investigation workflow
↓
Triage and incident confirmation
↓
Business context and priority
↓
Entity and scope identification
↓
Identity, endpoint, email and cloud investigation
↓
Sentinel and KQL hunting
↓
IOC and threat-intelligence enrichment
↓
ATT&CK and malware analysis
↓
Evidence correlation and complete timeline
↓
Validation, gaps and alternative explanations
↓
Containment, remediation and recovery
↓
Technical report, executive summary and lessons learned
Complete investigation model
| Phase | Evidence | Core question |
|---|---|---|
| Understand | Triage, summary, business context and initial scope. | What appears to have happened? |
| Investigate | Identity, endpoint, email, cloud, Sentinel and KQL. | What does each evidence domain show? |
| Correlate | Timeline, entities, indicators, ATT&CK and malware. | How do the chapters connect? |
| Validate | Sources, queries, confidence, gaps and alternatives. | What does the evidence actually prove? |
| Respond | Containment, remediation, recovery and monitoring. | How do we remove risk safely? |
| Communicate | Technical report, executive summary, handover and lessons. | How is the final story preserved and shared? |
Learning objectives
- Run a complete Microsoft security investigation.
- Use Security Copilot throughout the incident lifecycle.
- Combine identity, endpoint, email, cloud and Sentinel evidence.
- Use KQL, IOC enrichment, ATT&CK and malware analysis.
- Validate every conclusion and response decision.
- Produce technical and executive reporting.
- Close incidents with lessons learned.
What is an end-to-end investigation?
An end-to-end investigation follows an incident from initial alert or report through triage, scoping, evidence collection, containment, recovery and final reporting.
Start with the trigger
Record the alert, user report, hunting result or external notification that initiated the case.
Confirm the incident
Determine whether the trigger represents a true positive, benign activity, duplicate alert or unresolved event.
Establish ownership
Assign an incident owner, supporting analysts, approvers and escalation contacts.
Set the investigation window
Choose a time range broad enough to capture activity before and after the first alert.
Confirm the environment
Validate tenant, workspace, subscription, device group and affected business area.
Identify the primary entities
Record users, devices, mailboxes, files, IP addresses, domains, applications, alerts and cloud resources.
Use immutable identifiers
Preserve DeviceId, AccountObjectId, NetworkMessageId, AlertId, IncidentId and resource IDs.
Create the first summary
Use Security Copilot to create a draft incident summary before deeper pivots.
Validate the draft
Check every statement against the incident, alert and original source evidence.
Review the process log
Confirm which plugins, sources and intermediate steps produced the response.
Assess severity
Separate product severity from business priority and current operational impact.
Assess immediate risk
Identify active sessions, malicious processes, exposed systems and ongoing attacker access.
Preserve evidence
Capture the records required before containment or remediation changes the environment.
Build the initial timeline
Record first observed, first detected, latest activity and response actions.
Investigate identity
Review sign-ins, MFA, token use, authentication methods, risky activity, roles and privilege changes.
Validate the user
Confirm object ID, UPN, account type, aliases, role and device context.
Review session activity
Look for unusual IPs, user agents, geographies, devices and applications.
Check MFA activity
Review registration, challenge results, authentication strength and suspicious changes.
Check token abuse
Review session persistence, refresh-token activity and revocation requirements.
Check privilege changes
Review group membership, roles, service principals and consent changes.
Investigate endpoint
Review device context, alerts, process trees, files, registry, logons and network events.
Validate the device
Confirm DeviceId, hostname, OS, ownership, onboarding, risk and exposure.
Review process ancestry
Trace parent and child processes around suspicious execution.
Review command lines
Identify encoded commands, downloads, execution-policy changes and script activity.
Review file activity
Check file creation, modification, movement, origin, hashes and prevalence.
Review persistence
Check tasks, services, registry keys, startup mechanisms and exclusions.
Review network activity
Connect outbound destinations with the processes and users that generated them.
Investigate email
Review delivery, sender identity, authentication, URLs, attachments, clicks and post-delivery actions.
Validate the message
Use Network Message ID and attachment hashes to correlate email evidence.
Check related recipients
Identify other users who received or interacted with the same campaign.
Check post-delivery activity
Confirm remediation, user reporting and any delayed clicks or executions.
Investigate cloud activity
Review cloud alerts, resource activity, permissions, attack paths and workload context.
Validate the resource
Confirm the full resource ID, subscription, region, owner and criticality.
Review control-plane activity
Check deployments, policy changes, role assignments and configuration events.
Review data-plane activity
Check storage, database, file and service access where available.
Investigate Microsoft Sentinel
Search connected Microsoft and third-party data sources for missing context.
Confirm workspace coverage
Validate connectors, ingestion health, retention and table availability.
Review VPN evidence
Check remote sessions, source IPs, users and device context.
Review firewall evidence
Check source, destination, action, application and rule context.
Review DNS and proxy evidence
Look for suspicious domains, redirects, beaconing and process-owned traffic.
Review Linux and third-party logs
Include SSH, appliance, SaaS and custom telemetry where relevant.
Use KQL assistance
Ask Security Copilot to generate, explain or refine focused queries.
Validate KQL
Check tables, fields, time ranges, filters, joins and representative raw rows.
Hunt beyond the incident
Search before, after and outside grouped alerts for related behaviour.
Build a hunting hypothesis
State the expected behaviour, evidence sources and confirmation criteria.
Pivot across entities
Move between users, devices, files, messages, domains, IPs and resources.
Document negative findings
Record searched sources, time ranges and visibility limits when no evidence is found.
Enrich indicators
Review IPs, domains, URLs, hashes, certificates and related infrastructure.
Validate freshness
Check first seen, last seen, expiration, ownership and source date.
Search internal sightings
Identify devices, users, messages, applications and resources that observed the indicator.
Avoid reputation-only conclusions
External malicious labels do not prove internal compromise.
Use threat intelligence
Add actor, campaign, infrastructure and malware context carefully.
Separate assessment from fact
Distinguish external reporting, internal observation and analyst inference.
Map MITRE ATT&CK
Map supported behaviours to tactics, techniques and sub-techniques.
Avoid over-mapping
Do not assign every plausible technique without direct evidence.
Analyse suspicious files
Review identity, signature, prevalence, process context and sandbox results.
Analyse scripts and commands
Decode content safely and explain execution stages without running it casually.
Compare sandbox and internal evidence
A malicious sandbox result does not prove internal execution.
Correlate all evidence
Connect identity, endpoint, email, cloud, network and alert evidence using stable identifiers.
Challenge relationships
Time proximity and shared infrastructure do not automatically prove causation.
Build the complete timeline
Order validated events into a defensible chronological attack story.
Separate first observed and first detected
The first alert may occur long after the attack began.
Mark confidence
Classify events and relationships as confirmed, probable, possible or unsupported.
Mark gaps and contradictions
Keep missing telemetry and conflicting evidence visible.
Determine the attack path
Identify supported stages from initial access through impact.
Determine affected scope
Separate confirmed affected entities from suspected and unrelated entities.
Assess business impact
Confirm operational, customer, data and financial effects with business owners.
Assess current status
State whether activity is active, contained, recovering or unresolved.
Plan containment
Choose account, device, email, network and cloud actions based on evidence and impact.
Revoke sessions
Invalidate tokens and sessions when identity compromise is supported.
Isolate devices
Use isolation when endpoint evidence and business context justify the action.
Remove malicious email
Purge or quarantine related messages while preserving evidence.
Block indicators carefully
Assess shared infrastructure, prevalence and business dependencies before blocking.
Remediate persistence
Remove tasks, services, rules, consent and other confirmed persistence.
Recover services
Restore systems, validate controls and monitor for recurrence.
Validate response success
Confirm actions completed and attacker access was removed.
Monitor residual risk
Continue hunting for remaining sessions, files, identities and infrastructure.
Produce the technical report
Document evidence, timeline, queries, mappings, actions, gaps and conclusions.
Produce the executive summary
Explain what happened, impact, response, remaining risk and decisions required.
Prepare the handover
Record current status, completed work, open questions, owners and next steps.
Close the incident
Confirm exit criteria, evidence retention, lessons learned and final approval.
Improve detections
Turn validated behaviours into tuned hunting queries or analytics.
Improve playbooks
Update prompts, evidence checks, branches and automation based on lessons learned.
Measure investigation quality
Evaluate completeness, reproducibility, time to understand, time to contain and missed evidence.
Preserve Copilot contribution
Record prompts, sessions, sources and revisions that assisted the investigation.
Final analyst accountability
Security Copilot can connect the chapters, but the incident owner approves the final story.
Example end-to-end investigation prompt
Include:
1. Incident summary and business context
2. Confirmed users, devices, mailboxes, files and cloud resources
3. Identity, endpoint, email, network and cloud evidence
4. KQL hunting queries and representative raw rows
5. IOC enrichment and threat-intelligence context
6. Supported MITRE ATT&CK mappings
7. Suspicious-file or script analysis
8. Complete chronological timeline
9. Confirmed, probable, possible and unsupported conclusions
10. Containment, remediation, recovery and executive-summary recommendations
Identify missing telemetry, contradictory evidence and every source used before recommending operational action.
Agent Foskett investigation: “The whole story”
↓
The attachment had not been opened
↓
The incident initially appeared contained
↓
Agent Foskett searched the mailbox history
↓
A similar message had arrived two days earlier
↓
That attachment had executed
↓
Endpoint evidence showed encoded PowerShell
↓
The script downloaded a second-stage payload
↓
A scheduled task created persistence
↓
Threat intelligence linked the infrastructure to an active campaign
↓
Sentinel VPN and firewall logs revealed activity from another device
↓
Advanced hunting found the same behaviour on a third device
↓
Entra logs showed token abuse by the affected identity
↓
Cloud logs showed unusual SharePoint access
↓
No single alert contained the complete attack
↓
Security Copilot assembled the draft story
↓
Agent Foskett validated every event, entity and relationship
↓
The response expanded from one email to three devices, one identity and cloud access
↓
Only then did the whole incident become visible
End-to-end investigation validation checklist
| Area | Question | Validation action |
|---|---|---|
| Trigger | What started the investigation? | Record alert, report or hunt source. |
| Context | Is the correct tenant, incident and time range selected? | Confirm immutable identifiers. |
| Coverage | Are all relevant products and connectors available? | Document missing telemetry. |
| Entities | Which users, devices, messages and resources are confirmed? | Separate confirmed and suspected scope. |
| Timeline | Does each event have source evidence? | Validate timestamps and sequence. |
| Hunting | Were precursor and follow-on behaviours searched? | Run focused KQL and inspect raw rows. |
| Correlation | Are relationships technically supported? | Use stable identifiers and alternatives. |
| Response | Do actions match evidence and business impact? | Apply containment and approval criteria. |
| Reporting | Are technical and executive conclusions aligned? | Review scope, impact and residual risk. |
| Closure | Are recovery, monitoring and lessons complete? | Confirm exit criteria and ownership. |
Key takeaways
- Complete investigations combine evidence from multiple Microsoft products and connected data sources.
- Security Copilot assists with summaries, KQL, enrichment, ATT&CK, malware analysis and reporting.
- Identity, endpoint, email, cloud and Sentinel evidence should be correlated using stable identifiers.
- The first alert may reveal only one stage of a much larger attack.
- Every AI-generated conclusion requires source, entity, timeline and query validation.
- IOC reputation and threat intelligence provide context but do not replace internal evidence.
- Containment and blocking decisions require operational and business-impact review.
- Technical and executive reports should tell the same validated incident story at different levels of detail.
- Lessons learned should improve detections, prompts, playbooks and visibility.
- The incident owner remains accountable for the final investigation result.
What Agent Foskett connected
- Suspicious email
- Earlier message
- PowerShell execution
- Payload download
- Scheduled task
- Campaign infrastructure
- Additional devices
- Token abuse
- SharePoint access
- Final incident scope
Best practices
- Confirm the trigger.
- Use immutable IDs.
- Investigate every domain.
- Hunt beyond alerts.
- Validate every claim.
- Preserve the timeline.
- Contain with evidence.
- Report clearly.
- Learn from closure.
- Keep judgement human.
Related Agent Foskett resources
Module 3 complete
How do you perform an end-to-end incident investigation with Microsoft Security Copilot?
Security Copilot can assist throughout triage, identity, endpoint, email, cloud, hunting, enrichment, validation, response and reporting when analysts verify all claims against original evidence.
Microsoft Defender XDR and Sentinel incident investigation
Complete investigations combine Defender XDR security telemetry with Microsoft Sentinel workspace and third-party data to build a validated attack timeline and determine full incident scope.
End-to-end Microsoft security investigation workflow
A complete workflow covers incident confirmation, evidence collection, entity correlation, KQL hunting, IOC enrichment, ATT&CK mapping, malware analysis, containment, recovery, reporting and lessons learned.
