Microsoft Sentinel

Incident

AOT

Archive search

Check disposition of similar incidents.

AOT

AbuseIPDB

IP reputation

AOT

Defender

Identity context

AOT

More sources...

VirusTotal, HIBP, MDE

AOT

Enrichment

Gather crucial data for the analysis.

Ward AI

Classify path

Triage Risk context

→

Analysis Open questions, instant tool calls

Analysed incident

Evidence, classification, recommended steps and disposition draft.

JIT

Sign-ins

Called during classify

JIT

Process tree

Host lineage

JIT

File activity

Integrity window

JIT

More tools...

Hunts and lookups