You have a Microsoft 365 B5 subscription that uses Microsoft Defender XDR. You are investigating an incident You need to review the incident tasks…

To review the tasks and actions performed during an incident investigation in Microsoft Defender XDR, an analyst can use multiple features on the Incident page. The Tasks tab allows for the creation and tracking of specific investigation or remediation steps, showing their status (e.g., completed). The Activity log provides a comprehensive, auditable record of all actions and comments made by analysts on the incident itself, such as status changes or assignments. The Alert timeline, found within the Alerts tab, presents a chronological view of the alerts that constitute the incident, providing context for the actions taken. Together, these three components offer a complete picture of the investigation's progress and history.

A. Tasks only: This is incorrect because the Activity log and Alert timeline are also essential for a complete review of all actions performed, not just the formally defined tasks.

B. Tasks and Activity log only: This is incorrect as it omits the Alert timeline, which provides the crucial chronological context of the alerts and the actions taken on them.

C. Tasks and Alert timeline only: This is incorrect because it excludes the Activity log, which is the primary audit trail for all manual actions and comments on the incident object itself.

---

1. Microsoft Learn. "Manage incidents in Microsoft Defender XDR." Microsoft Docs. This document describes the components of the incident page

explicitly mentioning the Activity log: "The Activity log displays all the actions and comments on the incident

providing a record of all changes." This confirms its use for reviewing performed actions.

2. Microsoft Learn. "Use incident tasks in Microsoft Defender XDR to coordinate incident response." Microsoft Docs. This source details the purpose of the Tasks feature: "Microsoft Defender XDR includes incident tasks to help you automate and/or manually track tasks

processes

and workflows... Tasks can be added to an incident and are used to track the progress of investigation and remediation activities."

3. Microsoft Learn. "Investigate incidents in Microsoft Defender XDR." Microsoft Docs. In the section "Triage alerts

" this document explains the function of the Alerts tab

which contains the Alert timeline. It states

"The Alerts tab lists all the alerts related to the incident... This allows you to view and manage the alerts." Reviewing this timeline is a key part of understanding the investigation's flow.