Checklist
First-hour incident response checklist
Based on the article: Your first hour with a Defender XDR incident: triage, scoping and containment · 5 min read
The first hour of an incident shapes everything after it: contain too late and the attacker spreads; contain the wrong thing and you disrupt the business for nothing. This post is a routine for working a Microsoft Defender XDR incident in time boxes: claim it, understand the story, scope it with assets, evidence and advanced hunting, contain each asset with the right action, and leave a record the next person can pick up.
Verify
- The device page shows the device isolated or contained, and Action center history shows the actions completed.
- Rerunning your hunting queries returns no new activity from contained assets.
- The disabled account shows no new successful sign-ins, and no new alerts join the incident from the same assets.
Tips & gotchas
- Phone the user before isolating their laptop; email and Teams may not reach them afterwards.
- Save good pivots as shared queries so the next analyst starts faster.
- Don't release contained assets to make a complaint go away; finish eradication first.
- Practise the routine: the SC-200 study plan covers the skills behind it.