Microsoft SC-200 Exam - Topic 1 Question 117 Discussion

In Microsoft Defender XDR (and Microsoft Sentinel), the table that stores information about incidents---including their status, severity, classification, associated alerts, and related tasks---is the SecurityIncident table. This table is part of the advanced hunting schema and Microsoft Sentinel workspace schema when Microsoft Defender XDR incidents are synchronized to Log Analytics.

Microsoft's documentation for the SecurityIncident table describes it as:

''Contains information about incidents generated in Microsoft Sentinel or Microsoft 365 Defender, including incident title, ID, description, severity, provider, owner, and related entities. It can be used to track and analyze incidents and their associated alerts or tasks.''

When you need to display incidents in a workbook and also visualize incident tasks or actions performed under each one, you must query the SecurityIncident table. From there, you can join or expand incident details such as tasks or alert relationships for deeper investigation.

Other options are not suitable for this requirement:

SecurityEvent -- contains raw Windows event log data (e.g., logon events, process creation) and is unrelated to incident-level information.

SentinelAudit -- contains audit trail records of changes and administrative actions within Sentinel (e.g., who modified analytics rules), not incidents or tasks.

SecurityAlert -- contains individual alerts that may belong to incidents, but it doesn't include incident tasks or groupings by incident.

Therefore, to query incident information and related tasks in a workbook, the correct target table is SecurityIncident.