SC-200 practice question 24 of 35

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an incident. You need to review the incident tasks that…

Choose your answer, then check it against the explanation.

Domain Mitigate threats using Microsoft Defender XDR

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an incident. You need to review the incident tasks that were performed. The solution must include a query that will display the incidents in a workbook, and then display the tasks of each incident in another grid. Which table should you target in the query?

Answer options

Correct Answer:

Explanation

The SecurityIncident table is the central schema in Microsoft Sentinel and Microsoft Defender XDR for storing information about security incidents. To create a workbook that first displays a list of incidents and then shows the tasks for a selected incident, the initial query must target the SecurityIncident table. This table contains all the necessary high-level incident data, such as IncidentNumber, Title, Status, and Owner, which are required to populate the primary grid and serve as the basis for subsequent queries on related tasks or alerts.

Why Incorrect

B. SecurityEvent: This table contains raw event data from various sources (e.g., Windows Security Events) and is too granular for incident-level management and task tracking.

C. SentinelAudit: This table is used for auditing activities performed within Microsoft Sentinel, such as rule modifications, not for querying the details of security incidents themselves.

D. SecurityAlert: This table contains individual alerts. While incidents are composed of alerts, this table does not contain the overarching incident management information or associated tasks.

References

1. Microsoft Learn. "SecurityIncident table reference." Microsoft Sentinel schema. This document explicitly states

"The SecurityIncident table in the Log Analytics advanced SIEM schema contains details about security incidents." It lists columns like IncidentNumber

Title

Status

and Owner

which are essential for the described task.

2. Microsoft Learn. "Investigate incidents with Microsoft Sentinel." Microsoft Sentinel documentation. This guide details the incident investigation process

which revolves around the data stored in the SecurityIncident table. Section "Get more incident details" shows how incident properties are the primary focus.

3. Microsoft Learn. "Visualize and monitor your data." Microsoft Sentinel documentation. This document on workbooks explains how they are used to visualize data. It notes

"Microsoft Sentinel allows you to create custom workbooks from your data... you can create interactive reports with text

analytic queries...". The query for an incident-focused workbook would target the SecurityIncident table.

Question 24 of 35

Keep practicing

Take the free SC-200 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test