Record in Sentinel that gathers related alerts, evidence and entities into one case to investigate; each has a severity, a status and an owner.
Also called incident.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Microsoft Sentinel incident in context, with comparison tables and the common traps.
Terms in this definition
- RELATED
Fetches a column value from the lookup table, that is the one side of a many-to-one relationship, for whichever row is being evaluated. It therefore needs to run inside an iterator or a calculated column, where row context exists.
- Full control
Gives every right over protected content, EXTRACT included, plus the ability to alter or strip the encryption. Owners and the Rights Management issuer always hold it.