An analyst is investigating a single onboarded Windows endpoint in Microsoft Defender for Endpoint after an alert fired at 14:07. They need a chronological view of the events recorded on that one device, such as process creations, file writes, registry changes, and network connections around the alert time, so they can reconstruct exactly what happened on it. Which feature on the device page should the analyst open to see this ordered sequence of events for that device?
- AThe Security recommendations tab, which lists the configuration and posture weaknesses found on that device so the analyst can see the events that occurred on it leading up to the alert.
- BThe device timeline, which presents a chronological, filterable list of the events observed on that specific device, including process, file, registry, and network activity around the time the alert was raised. Correct
- CThe Discovered vulnerabilities tab, which enumerates the CVEs affecting software on that device so the analyst can review the sequence of activity recorded around the alert.
- DThe Software inventory tab, which shows the applications installed on that device so the analyst can trace the chronological events that ran on it before and after the alert.
Why A is wrong: Security recommendations surface vulnerability and configuration posture for the device through threat and vulnerability management, but they describe weaknesses to remediate, not the time-ordered runtime events the analyst needs to reconstruct the activity.
Why B is correct: The device timeline is the device-scoped chronological event view in Microsoft Defender for Endpoint, listing observed process, file, registry, and network events in time order so the analyst can reconstruct activity on that single endpoint around the alert.
Why C is wrong: Discovered vulnerabilities lists known CVEs in the device's installed software, which is useful for patching priorities but does not show any runtime process, file, or network events, so it cannot reconstruct what happened on the device.
Why D is wrong: Software inventory enumerates installed applications and versions for the device, which helps assess exposure, but it is a static list with no event timing, so it cannot provide the ordered sequence of activity the analyst requires.