Lesson 13 — Investigating Endpoint Incidents
Endpoint investigations turn scattered alerts, processes, files, commands and network events into a verified device attack story.
Security Copilot can accelerate device summaries, script analysis, file analysis and investigation pivots inside Microsoft Defender, but the analyst must still validate process relationships, timelines, persistence and response actions.
This lesson explains how to investigate endpoint incidents from the first alert through containment, live response, remediation and post-incident monitoring.
What you will learn
This lesson develops a complete Defender endpoint investigation and response workflow.
Endpoint-incident investigation workflow
↓
Confirm device identity, owner, risk and sensor health
↓
Generate the Copilot device or alert summary
↓
Review the alert story and device timeline
↓
Validate process trees, command lines, files and scripts
↓
Check persistence, credentials, network activity and lateral movement
↓
Correlate identity, email, cloud and Sentinel evidence
↓
Use advanced hunting to test the hypothesis and find related devices
↓
Preserve evidence
↓
Apply approved response actions
↓
Monitor for recurrence and document the final timeline
Endpoint evidence domains
| Domain | Evidence | Investigation question |
|---|---|---|
| Device context | Device ID, hostname, owner, OS, risk, exposure and sensor health. | Is this the correct and fully visible endpoint? |
| Process evidence | Parent-child relationships, command lines, users and integrity levels. | What executed and how? |
| File evidence | Hash, path, origin, signer, prevalence and related detections. | What payload or tool was involved? |
| Persistence | Tasks, services, registry, startup items and new accounts. | How could activity survive reboot or logon? |
| Network evidence | DNS, IPs, domains, ports, remote sessions and process ownership. | What did the device communicate with? |
| Response evidence | Isolation, scans, quarantine, live response and Action center status. | What was contained and what still remains? |
Learning objectives
- Investigate Defender endpoint alerts and devices.
- Analyse timelines and process trees.
- Review scripts, files and command lines.
- Identify persistence and lateral movement.
- Use hunting and live response.
- Validate isolation and remediation actions.
- Build a verified endpoint timeline.
Start with the device entity
Open the affected device in Microsoft Defender and confirm device ID, hostname, operating system, owner, risk level, exposure level and onboarding state.
Confirm device identity
Reimaged, renamed or duplicated endpoints can create misleading asset counts if immutable device identifiers are not checked.
Review incident and alert context
Understand which alert brought the device into scope and whether the endpoint activity is part of a broader Defender XDR incident.
Use the alert story
The alert story helps show related processes, files, users, IP addresses and events around the detection.
Generate the Copilot device summary
Security Copilot in Microsoft Defender can summarise device context, alerts, risk and notable activity to accelerate orientation.
Summary is not evidence
Treat the device summary as a draft that must be checked against the original alert, timeline and entity records.
Review the device timeline
Use the chronological device timeline to correlate processes, files, registry activity, network connections and user actions.
Filter the timeline
Limit the timeline by time range, event type, user, process, file or indicator to reduce noise.
Normalise timestamps
Use one stated time zone and preserve original timestamps when building the endpoint attack story.
Identify the first confirmed event
Distinguish the earliest verified malicious or suspicious event from assumptions about initial access.
Identify the latest confirmed event
Determine whether suspicious endpoint activity is still occurring or has already stopped.
Inspect the process tree
Review parent, child and grandchild process relationships rather than analysing a single process in isolation.
Validate parent-child relationships
A suspicious child process may be unrelated if it belongs to a different session, user or process chain.
Review command lines
Command-line arguments often reveal intent, downloaded content, encoded data, persistence or remote execution.
Use Copilot script analysis
Security Copilot can explain suspicious PowerShell, batch and bash scripts, but the analyst must validate behaviour and context.
Check obfuscation
Encoded, compressed or fragmented scripts can conceal behaviour and should be decoded and reviewed carefully.
Review PowerShell activity
Inspect execution policy changes, encoded commands, downloads, reflection, credential access and child processes.
Review LOLBins
Legitimate binaries such as rundll32, regsvr32, mshta, certutil and wmic can be abused and require contextual validation.
Inspect file evidence
Review file name, path, hash, origin, prevalence, signer, certificate, detections and related devices.
Use Copilot file analysis
Security Copilot can summarise suspicious files, including detection information, certificates, API calls and embedded strings.
Check digital signatures
A valid signature does not prove a file is safe, but missing, invalid or unexpected signing information can add context.
Check file prevalence
Low prevalence may increase interest, while high prevalence can indicate a common legitimate file or widespread malicious activity.
Review file origin
Determine whether the file arrived through email, browser download, archive, network share, USB, software deployment or another process.
Review file creation and modification
Track when the file appeared, which process created it and whether it was renamed or modified.
Review execution context
Confirm which user, integrity level, session and device executed the file or command.
Check persistence
Look for scheduled tasks, services, registry run keys, startup folders, WMI subscriptions, browser extensions and new accounts.
Scheduled tasks
Confirm task creator, trigger, action, run context and whether the task is expected administration.
Services
Review new or modified services, binary paths, start types and service-account context.
Registry persistence
Inspect run keys, shell changes, debugger settings and other registry locations used for persistence.
Startup locations
Check user and system startup folders, logon scripts and profile modifications.
Review credential access
Look for LSASS access, browser credential theft, token theft, dumping tools and suspicious security-process access.
Review network activity
Correlate outbound connections, DNS lookups, listening ports, remote hosts and process ownership.
Validate IP and domain ownership
Check whether network destinations belong to corporate services, CDNs, cloud providers, VPNs or malicious infrastructure.
Review DNS events
Unexpected domains, dynamic DNS and newly registered infrastructure can support an endpoint hypothesis.
Review browser activity
Browser downloads, extensions, redirects and user sessions can explain file delivery and credential theft.
Review remote access tools
Determine whether RDP, PsExec, WinRM, remote support software or administrative tooling was authorised.
Review lateral movement
Correlate logons, remote services, SMB, RDP, PsExec and credential use across source and destination devices.
Review USB activity
Check removable media, mounted devices, file copies and timing when data transfer or malware introduction is suspected.
Review user context
Confirm who was signed in, whether multiple users shared the device and whether activity occurred under a service account.
Review exposure and recommendations
Defender Vulnerability Management findings can explain why exploitation was possible but do not prove exploitation occurred.
Check software inventory
Review installed software, versions, vulnerabilities and recent changes relevant to the incident.
Check security controls
Confirm Defender Antivirus, EDR, firewall, tamper protection and sensor health during the incident period.
Check sensor health
Missing endpoint telemetry can indicate an offline device, unhealthy sensor, tampering or a collection gap.
Correlate with identity evidence
Match endpoint activity with Entra sign-ins, user risk, authentication changes and session context.
Correlate with email evidence
Determine whether phishing, attachments or URLs delivered the endpoint payload.
Correlate with cloud evidence
Check whether the device accessed cloud applications, resources or sensitive data after compromise.
Use advanced hunting
Query Defender XDR data to verify process, file, registry, network, logon and device events.
Validate generated KQL
Check table names, fields, time filters, device identifiers, joins and returned rows before using Copilot-generated queries.
Hunt beyond the original device
Search for the same hash, command line, domain, scheduled task or persistence method across other devices.
Review automated investigation
Check automated investigation findings, evidence and remediation actions before accepting them as complete.
Review Action center
Confirm pending, approved, completed and failed response actions in the Microsoft Defender Action center.
Collect an investigation package
Use the package to gather additional artefacts when deeper offline review is required.
Initiate live response
Live response provides a remote command session for authorised investigation and remediation on supported devices.
Use live response carefully
Commands can affect production systems and should follow permissions, approvals and documented procedures.
Isolate the device
Device isolation can contain network communication while preserving limited Defender connectivity.
Assess isolation impact
Check business criticality, remote access, dependencies and recovery requirements before isolating a device.
Run an antivirus scan
Use quick or full scans when appropriate, then review results and limitations.
Stop and quarantine files
File actions can interrupt malicious execution but require validation of business impact and false-positive risk.
Block indicators carefully
File or certificate blocking can affect many devices and should be scoped and approved.
Contain related devices
Use containment when high-confidence attack activity spans devices, while continuing to validate scope.
Preserve evidence before remediation
Capture timelines, process trees, scripts, hashes, network records and user context before destructive changes.
Document attack stages
Record execution, persistence, privilege escalation, credential access, lateral movement and command-and-control only when evidence supports them.
Separate exposure from compromise
A vulnerable device is exposed; a compromised device has evidence of attacker activity.
Separate suspicious from malicious
Unusual administration, software deployment and troubleshooting can resemble attacker behaviour.
Request alternative explanations
Ask Copilot to compare malware, approved IT activity, software deployment and user actions.
Assign confidence per finding
A file may be confirmed malicious while lateral movement remains only suspected.
Coordinate remediation
Work with system owners, identity teams, network teams and application owners when response affects production.
Monitor after containment
Watch for repeated activity, new devices, related identities, failed remediation and re-established persistence.
Close with a verified timeline
The final endpoint record should show what happened, what was contained, what remains unknown and who approved closure.
Example endpoint-investigation prompt
Include:
1. Device identity, owner, risk, exposure and sensor health
2. Relevant alerts and the proposed attack story
3. A chronological process and network timeline
4. Suspicious parent-child process relationships and command lines
5. Scripts, files, hashes, signatures, prevalence and origin
6. Persistence, credential access and lateral-movement evidence
7. Related identity, email, cloud and Sentinel activity
8. Confirmed facts, likely inference and legitimate alternatives
9. Recommended investigation and containment actions
10. Missing telemetry, failed actions and confidence level
Use one stated time zone and cite the source for every major finding.
Agent Foskett investigation: “The process tree crossed two devices…”
↓
The draft showed Word launching PowerShell
↓
PowerShell appeared to create a scheduled task
↓
The chain looked like phishing followed by persistence
↓
Agent Foskett opened the device timeline
↓
The Word process ran on the user’s laptop
↓
The scheduled task alert belonged to a server with a similar hostname
↓
The two devices shared the same user account
↓
The events occurred within the same five-minute window
↓
But no process relationship connected them
↓
The laptop contained a malicious document and short-lived PowerShell activity
↓
The server task was an approved backup job
↓
The endpoint incident was split into malicious laptop activity and legitimate server administration
↓
The process tree looked complete only because the device identity had been ignored
Endpoint-investigation validation checklist
| Area | Question | Validation action |
|---|---|---|
| Device | Is the correct immutable device ID in scope? | Confirm ID, hostname, owner and OS. |
| Timeline | Are events from the same device and session? | Check device ID, user and timestamps. |
| Process tree | Are parent-child relationships genuine? | Validate process IDs and execution context. |
| Script | Does the decoded script match the summary? | Review commands and behaviour directly. |
| File | What is the file’s origin, signer and prevalence? | Inspect file entity and related devices. |
| Persistence | Was a task, service or registry change actually created? | Open the original event and configuration. |
| Network | Which process owned the connection? | Correlate DNS, IP and process evidence. |
| Hunting | Does generated KQL return the expected events? | Test fields, filters and results. |
| Response | Did isolation, scan or quarantine complete? | Review Action center status. |
| Closure | Is recurrence or persistence still visible? | Monitor and record residual risk. |
Key takeaways
- Microsoft Defender device investigations use alerts, timelines, network connections, security assessments and related entities.
- Security Copilot in Microsoft Defender can generate device summaries and analyse suspicious scripts and files.
- Device identity must be confirmed before correlating process or alert activity.
- Process trees require validated parent-child relationships, users, sessions and timestamps.
- Files should be reviewed by origin, hash, signer, prevalence, certificates and behaviour.
- Persistence can involve tasks, services, registry keys, startup locations and new credentials.
- Advanced hunting can verify endpoint evidence and search for related activity across devices.
- Live response, isolation, scans and file actions require permissions, approval and business-impact review.
- Action center confirms whether response actions are pending, complete or failed.
- The final endpoint conclusion remains a human-validated security decision.
What Agent Foskett checked
- Immutable device ID
- Hostname and owner
- Device timeline
- Process IDs
- Command lines
- Scheduled task
- File origin
- Network activity
- Action center
- Final attack story
Best practices
- Confirm the device.
- Review the alert story.
- Filter the timeline.
- Validate process relationships.
- Inspect scripts and files.
- Check persistence.
- Hunt across devices.
- Preserve evidence.
- Approve response actions.
- Monitor after containment.
Related Agent Foskett resources
Continue the Microsoft Security Copilot Academy
How do you investigate endpoint incidents with Microsoft Security Copilot?
Security Copilot in Microsoft Defender can assist with incident summaries, device summaries, script analysis, file analysis and guided investigation while analysts validate device timelines and source evidence.
Microsoft Defender endpoint investigation workflow
A complete endpoint workflow reviews device identity, alerts, process trees, command lines, files, persistence, network activity, advanced hunting and response actions.
Defender live response and device isolation
Authorised analysts can use live response, device isolation, investigation packages, antivirus scans and file actions while reviewing approvals and completion status in Action center.
