Sentinel incidents: investigation graph, entity pages and UEBA insights, running playbooks on demand, incident tasks, closing with the right classification

A Microsoft Sentinel incident groups alerts from analytics rules together with their mapped entities. In the Azure portal you work incidents from the Incidents page; in the Defender portal, Sentinel incidents appear in the same unified queue as Defender XDR incidents. The steps are the same idea in both: assign, investigate, respond, document and close. The incident page shows a summary, the alerts, the entities, a timeline of alerts and bookmarks, similar incidents, and top insights from user and entity behavior analytics (UEBA). Comments and the activity log keep a record of everything done, and you can change severity, status and owner, and add tags.