Defender for Endpoint alerts: triage basics

Skills you'll practise

• Explain how alerts, incidents and device timelines relate in Defender for Endpoint.
• Read an alert's process story and identify the malicious step and any persistence.
• Classify an alert as true positive, informational/expected activity, or false positive, with evidence.
• Choose an appropriate first response action (for example isolate device, stop and quarantine file) and escalate.

Course outline

1. 1.Defender for Endpoint alerts: triage basicsVideo · 4 min
2. 2.Alerts, incidents and the device timelineLesson · 8 min
3. 3.Classifying alerts with evidenceLesson · 8 min
4. 4.First response actionsLesson · 8 min
5. 5.Defender for Endpoint alerts: triage basics: knowledge checkKnowledge check · 18 questions
6. 6.Final exam8 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• Microsoft Learn: Investigate alerts in Microsoft Defender for Endpoint
• Microsoft Learn: Incidents in Microsoft Defender XDR
• Microsoft Learn: Take response actions on a device
• Microsoft Learn: Take response actions on a file
• Microsoft Learn: Classify and resolve alerts