You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an incident. You need to review the incident tasks that were performed. The solution must include a…

The correct answer is A. SecurityIncident. SecurityIncident is the correct table because it stores incident-level data in Microsoft Sentinel, including metadata about tasks associated with each incident - making it the right target when you need to display incidents in a workbook and drill into their tasks in a…

Submitted by hans_de· Apr 18, 2026Manage incident response

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You are investigating an incident. You need to review the incident tasks that were performed. The solution must include a query that will display the incidents in a workbook, and then display the tasks of each incident in another grid. Which table should you target in the query?

Options

ASecurityIncident
BSecurityEvent
CSentinelAudit
DSecurityAlert

How the community answered

(21 responses)

A
95% (20)
D
5% (1)

Explanation

SecurityIncident is the correct table because it stores incident-level data in Microsoft Sentinel, including metadata about tasks associated with each incident - making it the right target when you need to display incidents in a workbook and drill into their tasks in a secondary grid.

SecurityEvent (B) captures Windows security event log data (logins, process creation, etc.) and has nothing to do with Sentinel incidents or their tasks. SentinelAudit (C) logs Sentinel platform activity like workspace configuration changes, not investigation workflows or incident tasks. SecurityAlert (D) holds individual alerts that may feed into an incident, but tasks are tracked at the incident level, not the alert level.

Memory tip: Think of it this way - Incidents have Tasks, and the SecurityIncident table is the home of incidents. If the question involves workbooks that navigate from incident → task, you're always starting from SecurityIncident.

Topics

#Microsoft Defender XDR#KQL#Incident Management#Advanced Hunting

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice