# All active Microsoft Defender XDR incidents are triaged and remediated
A Microsoft Defender XDR incident is a correlation of related alerts across endpoints, identities, email, and cloud apps that represents a single attack…
Source: https://maester.dev/docs/tests/ZTA.41061
## Overview
A Microsoft Defender XDR incident is a correlation of related alerts across endpoints, identities, email, and cloud apps that represents a single attack story. When active incidents accumulate without triage, the threat actor's progress — from initial phishing, to credential theft, to lateral movement, to data staging — is recorded in telemetry but never acted on; the dwell time grows, and an intrusion that could have been contained at the credential stage proceeds to exfiltration and impact. This check confirms there are no active incidents that have not been assigned, classified, and either remediated or resolved within the response window the security team has committed to, so the unified incident view drives action rather than only visibility.
## Remediation
- [Incidents overview in Microsoft Defender XDR](https://learn.microsoft.com/en-us/defender-xdr/incidents-overview)
- [Manage incidents](https://learn.microsoft.com/en-us/defender-xdr/manage-incidents)
- [Investigate incidents](https://learn.microsoft.com/en-us/defender-xdr/investigate-incidents)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Threat investigation and response |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Tenant settings |
| Area | Logging and detection |
| Licence | WINDEFATP, MDE_LITE, ATP_ENTERPRISE, THREAT_INTELLIGENCE, ATA, ADALLOM_S_STANDALONE, MDE_SMB |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.