Investigate and manage Microsoft Sentinel incidents using agentic AI, embedded Copilot for Security, and case management.

A lead analyst is running a complex investigation that spans a Microsoft Sentinel incident, several related alerts, and notes gathered from interviews with affected staff. They want a single record that ties together the linked incidents and alerts, supports collaboration with assigned collaborators, and tracks the investigation as a managed work item across its lifecycle in the Microsoft Defender portal. Which construct should the analyst use to consolidate and manage this investigation?

• AA second Microsoft Sentinel incident created manually, into which the analyst copies the alerts from the original incident so that all of the related evidence is gathered under one new incident record.
• BA bookmark saved from an advanced hunting result, which preserves the queried records the analyst found and lets them annotate the rows so the evidence is kept for later reference during the investigation.
• CA workbook saved for the investigation, which dashboards the incident and alert data together so the team can view the linked evidence and progress of the investigation in one shared visual report.
• DA case in unified case management, which links the related incidents and alerts into one managed record and supports assigned collaborators, status, and notes to track the investigation across its lifecycle.check_circle Correct

Why A is wrong: Creating another incident and copying alerts duplicates data rather than consolidating it, and an incident is a single detection grouping, not a cross-incident work item with collaborators and lifecycle tracking, so it does not serve as the managed investigation record.

Why B is wrong: A bookmark stores hunting findings and notes about specific records, but it captures evidence fragments rather than linking incidents and alerts into one collaborative managed work item, so it cannot consolidate or track the whole investigation.

Why C is wrong: A workbook visualises data for shared viewing but holds no case state, assigned collaborators, or lifecycle status, so it presents the evidence rather than acting as the managed record that ties the investigation together.

Why D is correct: A case is the case-management record that aggregates linked incidents and alerts into a single managed work item with collaborators, status, and notes, which is exactly the consolidated, lifecycle-tracked investigation container the analyst needs.