All active Microsoft Defender XDR incidents are triaged and remediated

Overview

A Microsoft Defender XDR incident is a correlation of related alerts across endpoints, identities, email, and cloud apps that represents a single attack story. When active incidents accumulate without triage, the threat actor’s progress — from initial phishing, to credential theft, to lateral movement, to data staging — is recorded in telemetry but never acted on; the dwell time grows, and an intrusion that could have been contained at the credential stage proceeds to exfiltration and impact. This check confirms there are no active incidents that have not been assigned, classified, and either remediated or resolved within the response window the security team has committed to, so the unified incident view drives action rather than only visibility.

Remediation

• Incidents overview in Microsoft Defender XDR
• Manage incidents
• Investigate incidents

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	SecOps
Category	Threat investigation and response
Product	Defender
Feature	Tenant settings
Area	Logging and detection
Licence	WINDEFATP, MDE_LITE, ATP_ENTERPRISE, THREAT_INTELLIGENCE, ATA, ADALLOM_S_STANDALONE, MDE_SMB
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.