Incident response is a structured, time-sensitive process. In Microsoft Sentinel, every alert becomes a potential incident — triaged, investigated, and resolved within a single platform that combines SIEM, SOAR, and threat intelligence. The quality of your IR process determines how quickly threats are contained and how much damage is prevented.

This guide walks through each IR phase with the Sentinel features and KQL queries you need at every stage — from the first alert to the final post-incident review.

1. IR Phases Overview

2. Phase 1: Triage & Initial Assessment

Triage answers one question: is this a true positive that requires IR, or a false positive to tune away? Sentinel’s incident queue shows every open incident with severity, assigned analyst, and the alert(s) that triggered it.

Triage questions to answer in the first 5 minutes

• What triggered the alert — what specific behaviour was detected?
• Which user, device, or IP is the primary entity?
• Has this exact alert fired before for this entity? (Check incident history on the entity page)
• What is the entity’s risk score from UEBA?
• Are there correlated alerts across multiple detection sources for the same entity?

// Triage: Active incidents by severity — your queue
SecurityIncident
| where TimeGenerated > ago(24h)
| where Status == "Active"
| project IncidentNumber, Title, Severity, CreatedTime,
          Owner = tostring(Owner.assignedTo), AlertCount = toint(AdditionalData.alertsCount)
| order by case(Severity,"High",1,"Medium",2,"Low",3,4) asc, CreatedTime asc

// Check alert history for a specific entity (user)
SecurityAlert
| where TimeGenerated > ago(30d)
| where Entities has "user@domain.com"
| project TimeGenerated, AlertName, AlertSeverity, Status
| order by TimeGenerated desc

3. Phase 2: Scoping & Containment

Once you confirm a true positive, immediately scope the incident — how far has the threat spread? — and contain it in parallel. Do not wait for full investigation before containing.

Rapid containment actions in Sentinel

• Block IP — trigger a playbook to add the IP to your firewall blocklist or Conditional Access named locations
• Disable user account — trigger a playbook to call Azure AD to disable the compromised account
• Isolate device — trigger a Defender for Endpoint playbook to isolate the host from the network
• Revoke sign-in sessions — call Microsoft Graph to revoke all active refresh tokens for the user

// Scope: all activity from a suspicious IP in the last 7 days
let SuspiciousIP = "1.2.3.4";
union SigninLogs, CommonSecurityLog, AzureActivity
| where TimeGenerated > ago(7d)
| where IPAddress == SuspiciousIP or SourceIP == SuspiciousIP or CallerIpAddress == SuspiciousIP
| project TimeGenerated, Type, OperationName, UserPrincipalName, IPAddress, SourceIP, CallerIpAddress
| order by TimeGenerated desc

// Scope: all devices that communicated with a C2 IP
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationIP == "1.2.3.4" or SourceIP == "1.2.3.4"
| summarize
    FirstSeen  = min(TimeGenerated),
    LastSeen   = max(TimeGenerated),
    BytesSent  = sum(SentBytes)
  by SourceIP, DestinationIP, DeviceVendor
| order by LastSeen desc

4. Phase 3: Deep Investigation

Deep investigation reconstructs the full attack chain — initial access, lateral movement, persistence, and objectives. Use Sentinel bookmarks to tag critical evidence as you build the timeline.

// Timeline: all events for a compromised user
let CompromisedUser = "user@company.com";
let StartTime = datetime(2026-05-01);
let EndTime   = datetime(2026-05-09);
union
    (SigninLogs
     | where UserPrincipalName == CompromisedUser
     | project TimeGenerated, EventType="SignIn", Detail=strcat(ResultDescription," from ",IPAddress,
               " (",tostring(LocationDetails.countryOrRegion),")")),
    (AuditLogs
     | where InitiatedBy has CompromisedUser
     | project TimeGenerated, EventType="AuditOp", Detail=OperationName),
    (SecurityAlert
     | where Entities has CompromisedUser
     | project TimeGenerated, EventType="Alert", Detail=strcat(AlertName," [",AlertSeverity,"]"))
| where TimeGenerated between (StartTime .. EndTime)
| order by TimeGenerated asc

// Lateral movement: logons from a compromised host to other internal hosts
let CompromisedHost = "WORKSTATION-01";
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624
| where Computer != CompromisedHost
| where IpAddress == (
    SecurityEvent
    | where Computer == CompromisedHost
    | summarize IP = any(IpAddress)
    | project IP)
| summarize TargetHosts = make_set(Computer) by Account, IpAddress

5. Phase 4: Eradication & Recovery

Eradication removes all attacker footholds — scheduled tasks, registry run keys, rogue user accounts, and any persisted access. Recovery restores systems to a verified clean state.

• Reset credentials for all affected accounts — not just the primary compromised account
• Review and revoke all OAuth app grants for affected users
• Check and remove any persistence: scheduled tasks, registry run keys, new local admin accounts
• Verify MFA is enforced for recovered accounts before re-enabling them
• Patch the vulnerability or misconfiguration that enabled initial access

// Check for new admin accounts created during incident window
SecurityEvent
| where TimeGenerated between (datetime(2026-05-01) .. datetime(2026-05-09))
| where EventID == 4720                    // User account created
   or EventID == 4732                      // Member added to local admin group
| project TimeGenerated, EventID, SubjectAccount, TargetAccount, Computer

// Check for new OAuth app grants (possible persistence via app)
AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName == "Consent to application"
| extend App = tostring(TargetResources[0].displayName)
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| project TimeGenerated, Actor, App, Result

6. Key IR KQL Queries

Detect active C2 beacon (regular intervals)

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor has_any ("Palo Alto","Fortinet","Check Point")
| summarize
    ConnCount      = count(),
    AvgInterval    = avg(datetime_diff('minute', TimeGenerated, prev(TimeGenerated))),
    BytesTotal     = sum(SentBytes + ReceivedBytes)
  by SourceIP, DestinationIP, DestinationPort
| where ConnCount > 50
| where AvgInterval < 5             // Regular intervals under 5 minutes = beaconing indicator
| order by ConnCount desc

PowerShell with encoded command (common malware delivery)

SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4688
| where NewProcessName has "powershell"
| where CommandLine has_any ("-EncodedCommand","-enc ","-e ","-ec ")
| project TimeGenerated, Account, Computer, NewProcessName, CommandLine
| order by TimeGenerated desc

7. Sentinel Playbooks for IR Automation

Playbooks (Logic Apps) automate repetitive IR actions, reducing mean time to respond (MTTR). Key IR playbooks to have ready:

• Block-IP-in-Firewall — add SourceIP to a named firewall group or Conditional Access policy
• Disable-AAD-User — call Microsoft Graph API to set accountEnabled: false
• Isolate-MDE-Device — call Defender for Endpoint API to isolate a device
• Revoke-User-Sessions — call Graph to revoke all refresh tokens (revokeSignInSessions)
• Notify-Analyst-Teams — post incident details to the SOC Teams channel with direct incident link