13.3 Setting Up Your Investigation

Setting Up Your Investigation

Experienced analysts do not start typing queries the moment an alert fires. They set up their workspace, gather context, and plan their approach. Thirty seconds of preparation saves thirty minutes of scattered, unfocused investigation.

Open these tools

Before writing your first query, have these open and ready:

1. Defender XDR portal → Incidents & alerts (the alert that triggered this investigation)
2. Defender XDR portal → Advanced Hunting (your KQL workspace)
3. Defender XDR portal → Email & collaboration → Explorer (Threat Explorer for email analysis)
4. Entra ID portal → Sign-in logs (for quick entity lookups)
5. A text editor or OneNote → for documenting your investigation as you go

Evidence collection plan

Before you touch a single log, decide what evidence you need to preserve. If this incident leads to legal proceedings, regulatory reporting, or insurance claims, you need an evidence chain.

Preserve immediately:

• Screenshot or export the original alert with all metadata
• Export the phishing email (if still available in quarantine) including full headers
• Note the current time and your identity as the investigator

Preserve during investigation:

• Screenshot every KQL query and its results (or export to CSV)
• Screenshot any portal pages showing alert detail, entity information, or remediation actions
• Record every containment action with timestamp

Preserve after containment:

• Export the complete sign-in log for affected users (30-day window)
• Export the unified audit log for affected mailboxes (relevant timeframe)
• Record the removal of any persistence mechanisms (inbox rules, forwarding)

Your investigation query template

Start every investigation with this template. It defines your variables once and references them throughout:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

// === INVESTIGATION: INC-2026-0227-001 ===
// Analyst: [your name]
// Date: 2026-02-27
// Status: Active
//
// Affected users (update as investigation progresses):
let affected_users = dynamic([
    "j.morrison@northgateeng.com"
]);
//
// Known attacker IPs (update as investigation progresses):
let attacker_ips = dynamic([
    "203.0.113.45"
]);
//
// Phishing domains (update as investigation progresses):
let phishing_domains = dynamic([
    "northgate-voicemail.com"
]);
//
// Investigation timeframe:
let incident_start = datetime(2026-02-27T09:00:00Z);
let incident_end = datetime(2026-03-02T00:00:00Z);

Update these variables as the investigation progresses. When you identify a new compromised user, add them to affected_users. When you find a new attacker IP, add it to attacker_ips. Every subsequent query references these variables instead of hardcoding values.