Security Incidents
Microsoft Defender incidents - investigate, respond and automate.
| ID | Title | Severity | Status | Classification | Assigned To | Alerts | MITRE | Updated |
|---|---|---|---|---|---|---|---|---|
| INC-01001 | Suspicious PowerShell activity followed by credential access | High | Active | Unknown | soc | 2 | T1059.001 T1003.001 T1055 | 2026-08-18 22:07 |
| INC-01002 | Ransomware-related file encryption activity on file server | Critical | Active | Unknown | - | 1 | T1486 T1490 | 2026-08-17 22:07 |
| INC-01003 | Lateral movement via SMB from compromised workstation | High | Active | Unknown | - | 1 | T1021.002 T1570 | 2026-08-16 22:07 |
| INC-01004 | Phishing email with macro-enabled document delivered | Medium | Active | Unknown | - | 1 | T1566.001 T1204.002 | 2026-08-15 22:07 |
| INC-01005 | Backup service account password spray attempt | Medium | Active | Unknown | - | 1 | T1110.003 | 2026-08-13 22:07 |
| INC-01006 | Backdoor web shell deployed on application server | High | Resolved | Truepositive | soc | 1 | T1505.003 | 2026-08-09 22:07 |
