Defender portal incident queue: triage, assignment, attack story, alert correlation, linking alerts and merging incidents, classification and determination

An alert is a single detection. An incident is a collection of related alerts and the evidence behind them that together tell the story of one attack. Defender XDR (extended detection and response) automatically correlates alerts from endpoint, identity, email, cloud apps and, with Sentinel onboarded, security information and event management (SIEM) sources into incidents, based on shared entities such as the same user, device, file or IP address, and on timing. Working at the incident level saves time and shows the whole attack instead of fragments, which is why the security operations center (SOC) queue is built around incidents rather than alerts.