3.3MS-102Advanced

Est: ~15 mins•Verified: 2026-08

Defender XDR: Incident Correlation, AIR & Advanced Hunting

Master unified enterprise threat detection and response across endpoints, identities, emails, and cloud apps using Microsoft Defender XDR incident correlation, Automated Investigation and Response (AIR), and KQL Advanced Hunting.

Tags:#Microsoft 365#MS-102#Defender XDR#Incident Response#AIR#Advanced Hunting#KQL#SOC

Overview

Microsoft Defender XDR (formerly Microsoft 365 Defender) correlates signals across endpoints (Defender for Endpoint), identities (Defender for Identity), emails and collaboration (Defender for Office 365), and SaaS apps (Defender for Cloud Apps) into unified Incidents. The core SecOps components include:

Automatic Incident Correlation: Groups related low-fidelity alerts into a single cohesive story, reducing alert fatigue by up to 80% and revealing the end-to-end cyber kill chain.
Automated Investigation and Response (AIR): Uses AI playbooks to automatically inspect evidence, determine verdicts (Malicious, Suspicious, Clean), and generate remediation actions.
Action Center (Unified Remediation): Approves, rejects, or audits remediation actions (e.g., isolating a compromised device, disabling a compromised user, deleting malicious phishing emails from all inboxes).
Advanced Hunting: A Kusto Query Language (KQL) threat hunting interface querying up to 30 days of raw telemetry across all XDR workloads.

---

When to Use: AIR Automation Levels Comparison

Automation Level	Behavior	Best Used For
Full Automation (Auto-remediate)	AIR automatically takes remediation actions without waiting for human approval.	High-confidence production endpoints and standardized malware outbreaks.
Semi-Automation (Require approval)	AIR investigates and proposes actions; SecOps analyst must approve in Action Center.	Mission-critical servers, executive laptops, and sensitive environments.
No Automation (Alert only)	Automated investigation is disabled; purely manual SecOps triage.	Specialized lab or penetration testing environments.

---

Prerequisites

Administrator Permissions:

Security Administrator, Security Operator, or custom unified RBAC in Defender XDR.
Microsoft 365 E5 or Microsoft Defender XDR licenses assigned.

---

Portal Path

TEXT

Microsoft Defender Portal (https://security.microsoft.com)
├── Incidents & alerts
│   ├── Incidents (Correlated threat incidents across kill chain)
│   └── Alerts (Raw alerts from Endpoint, Identity, Office, Cloud Apps)
├── Actions & submissions
│   ├── Action center (Pending approvals, History of remediations)
│   └── Submissions (Submit suspicious files / emails for MS analysis)
└── Hunting
    └── Advanced hunting (Execute multi-table KQL queries across Device, Email, Identity)

---

Step-by-Step Implementation

Step 1: Triage an Incident in Defender XDR

Navigate to Microsoft Defender Portal > Incidents & alerts > Incidents.
Select an incident (e.g., Multi-stage incident involving Initial access & Lateral movement).
Inspect the Attack story:

Trace initial phishing email delivery (Defender for O365).
Trace executable payload launch on user laptop (Defender for Endpoint).
Trace suspicious Kerberos ticket-granting request (Defender for Identity).

Assign the incident to an analyst, set classification (e.g., True positive), and assign severity.

Step 2: Approve Remediation Actions in Action Center

Navigate to Actions & submissions > Action center > Pending.
Review proposed automated actions:

Quarantine file: invoice_malicious.exe
Isolate device: DESKTOP-FIN09
Soft delete email message from 14 internal recipient inboxes

Click Approve to execute the remediations across all vectors in seconds.

Step 3: Run Proactive Threat Hunting with KQL

Navigate to Hunting > Advanced hunting.
Execute multi-vector correlation query to identify persistence mechanisms (see Section 06).
Create a Custom detection rule from the query to trigger automated alerts on future recurrence.

---

KQL & PowerShell Scripts

Advanced Hunting KQL: Correlate Phishing Email to Endpoint Process Execution

KUSTO

// Query: Find users who clicked an email link and subsequently launched PowerShell
let suspiciousUsers = 
    EmailEvents
    | where DeliveryAction == "Delivered"
    | where ThreatTypes has "Phish" or ThreatTypes has "Malware"
    | distinct RecipientEmailAddress;
EmailUrlInfo
| where RecipientEmailAddress in (suspiciousUsers)
| join kind=inner (
    DeviceEvents
    | where ActionType == "BrowserLaunchedToOpenUrl"
) on $left.Url == $right.RemoteUrl
| join kind=inner (
    DeviceProcessEvents
    | where FileName in~ ("powershell.exe", "cmd.exe", "pwsh.exe")
    | where ProcessCommandLine has_any ("-enc", "DownloadString", "Invoke-Expression", "iex")
) on DeviceId
| project Timestamp, RecipientEmailAddress, DeviceName, Url, FileName, ProcessCommandLine
| order by Timestamp desc

PowerShell: Isolate Compromised Device and Revoke User Tokens

PowerShell

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.ReadWrite.All"

$compromisedUPN = "john.doe@contoso.com"
$user = Get-MgUser -Filter "userPrincipalName eq '$compromisedUPN'"

# 1. Immediately revoke all active refresh tokens (force sign-out across all devices)
Revoke-MgUserSignInSession -UserId $user.Id
Write-Host "Revoked active sessions for $compromisedUPN" -ForegroundColor Red

# 2. Disable the compromised user account pending forensics
Update-MgUser -UserId $user.Id -AccountEnabled:$false
Write-Host "Account $compromisedUPN has been disabled." -ForegroundColor Yellow

---

Verification Checklist

VERIFICATION CHECKLIST

0/5 (0%)

Incident graph displays correlated alerts across Endpoint, Identity, and Email.

AIR investigation automatically launches upon detection of high-severity alerts.

Action Center lists pending remediations; approved actions show in the History tab.

Device isolation allows only Microsoft Defender cloud connectivity (isolates local LAN and internet).

Custom detection rule runs every 1 to 24 hours and populates new alerts in the queue.

Common Pitfalls & Troubleshooting Matrix

Issue	Root Cause	Resolution
AIR actions stuck in pending state	Device group automation level is configured as Semi-automated (Require approval).	Review and approve actions in the Action Center, or switch device group to Full automation.
Advanced Hunting query times out	Query timeframe is too broad (> 7 days) without adequate table filters (`where`).	Filter by specific `Timestamp` (`where Timestamp > ago(24h)`) and filter by `FileName` or `DeviceId` early.
Defender for Identity alerts not appearing in XDR	Sensor is disconnected or domain controller event auditing is misconfigured.	Verify sensor health in Settings > Endpoints > Sensors and check SACL audit policies on Active Directory objects.
Isolated device cannot receive commands	Device was powered off or network disconnected before isolation script reached it.	The isolation command queues in cloud and executes immediately when device reconnects.

---

Real-World Architecture / Flow

Interactive Topology & Workflow

Unified Attack Chain in Microsoft Defender XDRsecurity

Stage 1

---

Audit & Monitoring

Monitor SOC team triage velocity using Defender Incident Reports:
MTTD (Mean Time to Detect) & MTTR (Mean Time to Respond).
Audit actions taken by administrators in Action Center:
Tab: Actions & submissions > Action center > History > filter by Approver.

---

Rollback & Emergency Recovery

Release Isolated Device:
In Defender Portal > Device inventory > select device > click Release from isolation.
Undo Action Center Remediation:
In Action center > History, select quarantined file and click Undo to restore original file.

---

Official Documentation Reference

---

Exam Blueprint & Pro Tips (MS-102)

Exam Blueprint & High-Yield Traps

MS-102 High-Yield Rules:

30-Day Hunting Retention: Advanced Hunting stores raw telemetry for 30 days. Custom detection rules can check up to the last 24 hours of data.
Device Isolation Connectivity: An isolated device cuts off all network connectivity EXCEPT communication with the Microsoft Defender cloud management service.
Live Response Feature: Live Response allows SecOps analysts to establish a remote command shell to investigate processes, collect memory dumps, and run remediation scripts.
AIR Verdicts: Automated investigation verdicts are: Malicious, Suspicious, No threats found, or Remediated.

PREVIOUS TOPIC3.2 Defender for Cloud Apps: Shadow IT & Session Control NEXT TOPIC4.1 Purview Data Loss Prevention (DLP): Credit Cards & PII