Incident response overview
Incident response is the practice of investigating and remediating active attack campaigns on your organization. This is part of the security operations (SecOps) discipline and is primarily reactive in nature.
Incident response has the largest direct influence on the overall mean time to acknowledge (MTTA) and mean time to remediate (MTTR) that measure how well security operations are able to reduce organizational risk. Incident response teams heavily rely on good working relationships between threat hunting, intelligence, and incident management teams (if present) to actually reduce risk. See SecOps metrics for more information.
For more information on security operations roles and responsibilities, see Cloud SOC functions.
New-to-role resources
If you're new-to-role as a security analyst, see these resources to get you started.
Topic | Resource |
---|---|
SecOps planning for incident response | Incident response planning for preparing your organization for an incident. |
SecOps incident response process | Incident response process for best practices on responding to an incident. |
Incident response workflow | Example incident response workflow for Microsoft 365 Defender |
Periodic security operations | Example periodic security operations for Microsoft 365 Defender |
Investigation for Microsoft Sentinel | Incidents in Microsoft Sentinel |
Investigation for Microsoft 365 Defender | Incidents in Microsoft 365 Defender |
Experienced security analyst resources
If you're an experienced security analyst, see these resources to quickly ramp up your SecOps team for Microsoft security services.
Topic | Resource |
---|---|
Microsoft Sentinel | How to investigate incidents |
Microsoft Defender for Cloud (Azure resources) | How to investigate alerts |
Microsoft 365 Defender | How to investigate incidents |
Security operations establishment or modernization | Azure Cloud Adoption Framework articles for SecOps and SecOps functions |
Microsoft security best practices | How to best use your SecOps center |
Incident response playbooks | Overview at https://aka.ms/IRplaybooks - Phishing - Password spray - App consent grant |
SOC Process Framework | Microsoft Sentinel |
MSTICPy and Jupyter Notebooks | Microsoft Sentinel |
Blog series about SecOps within Microsoft
See this blog series about how the SecOps team at Microsoft works.
- Part 1 – Organization: Mission and Culture
- Part 2a – People: Teams, Tiers, and Roles
- Part 2b – People: Careers and Readiness
- Part 3a – Technology: SOC Tooling
- Part 3b – Technology: Day in life of an analyst
- Part 3c – A day in the life part 2 - Microsoft Security
- Part 3d – Zen and the art of threat hunting
Simuland
Simuland is an open-source initiative to deploy lab environments and end-to-end simulations that:
- Reproduce well-known techniques used in real attack scenarios.
- Actively test and verify the effectiveness of related Microsoft 365 Defender, Microsoft Defender for Cloud, and Microsoft Sentinel detections.
- Extend threat research using telemetry and forensic artifacts generated after each simulation exercise.
Simuland lab environments provide use cases from a variety of data sources including telemetry from Microsoft 365 Defender security products, Microsoft Defender for Cloud, and other integrated data sources through Microsoft Sentinel data connectors.
In the safety of a trial or paid sandbox subscription, you can:
- Understand the underlying behavior and functionality of adversary tradecraft.
- Identify mitigations and attacker paths by documenting preconditions for each attacker action.
- Expedite the design and deployment of threat research lab environments.
- Stay up to date with the latest techniques and tools used by real threat actors.
- Identify, document, and share relevant data sources to model and detect adversary actions.
- Validate and tune detection capabilities.
The learnings from Simuland lab environment scenarios can then be implemented in your production environment and security processes.
See this overview of Simuland and the resources at the Simuland GitHub repository.
Incident response resources
- Planning for your SOC
- Process for incident response process recommendations and best practices
- Playbooks for detailed guidance on responding to common attack methods
- Microsoft 365 Defender incident response
- Microsoft Defender for Cloud (Azure)
- Microsoft Sentinel incident response
Key Microsoft security resources
Resource | Description |
---|---|
2021 Microsoft Digital Defense Report | A report that encompasses learnings from security experts, practitioners, and defenders at Microsoft to empower people everywhere to defend against cyberthreats. |
Microsoft Cybersecurity Reference Architectures | A set of visual architecture diagrams that show Microsoft's cybersecurity capabilities and their integration with Microsoft cloud platforms such as Microsoft 365 and Microsoft Azure and third-party cloud platforms and apps. |
Minutes matter infographic download | An overview of how Microsoft's SecOps team does incident response to mitigate ongoing attacks. |
Azure Cloud Adoption Framework security operations | Strategic guidance for leaders establishing or modernizing a security operation function. |
Microsoft security best practices for security operations | How to best use your SecOps center to move faster than the attackers targeting your organization. |
Microsoft cloud security for IT architects model | Security across Microsoft cloud services and platforms for identity and device access, threat protection, and information protection. |
Microsoft security documentation | Additional security guidance from Microsoft. |
Feedback
Submit and view feedback for