How Do You Add a Defender for Cloud Apps Alert to a Sentinel Incident?
Detect threats by using the Microsoft Sentinel platform
Investigate Microsoft 365 activities to identify threats
Answer
Correct answer: A — Use the entity side panel’s Timeline card in Microsoft Sentinel’s investigation view to add the Defender for Cloud Apps alert to the incident.
You have a Microsoft Sentinel workspace that uses the Microsoft 365 Defender data connector. From Microsoft Sentinel, you investigate a Microsoft 365 incident. You need to update the incident to include an alert generated by Microsoft Defender for Cloud Apps. What should you use?
Community Insight
The exam tests whether you can locate the Sentinel feature that adds related alerts to an incident, and the trap is choosing the incident’s Timeline tab or the Defender portal Alerts page instead of the entity side panel’s Timeline card.
This SC-200 question tests how Microsoft Sentinel incident investigation exposes related Microsoft 365 Defender alerts through the entity timeline. The page establishes that to add a Defender for Cloud Apps alert to an existing Sentinel incident, you use the entity side panel’s Timeline card (option A).
A common mistake is selecting the Timeline tab on the Sentinel incidents page or the Alerts page in the Microsoft 365 Defender portal, because neither action adds the Defender for Cloud Apps alert to the Sentinel incident.
Community Discussion (31 comments)
belyo
👍 1
Selected: AC
A & C are valid ways to do it Relate alerts to incidents in Microsoft Sentinel in the Azure portal: 1) using the entity timeline 2) using the investigation graph 3) using playbooks 4) using the API https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents#add-alerts-using-the-entity-timeline-preview
JN_311
👍 4
Selected: D
D. the Alerts page in the Microsoft 365 Defender portal
Takakage
👍 1
Selected: A
The entity side panel of the Microsoft Sentinel timeline card is correct. In the new incident experience of Microsoft Sentinel (currently in preview), you can use the entity timeline to add alerts. This feature allows you to view all entities for a specific incident investigation and add alerts from the side panel. Therefore, if you are using the preview feature, this option is correct. Even considering that the entity timeline feature is in preview, it is the correct choice based on the content of the SC-200 certification exam. It is also important to understand the latest features and methods, as preview features may be included in the exam. cf:https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents#add-alerts-using-the-entity-timeline-preview
Tuitor01
👍 1
Real life experience : Incidents blade > Select Incident > View full details in the right pane > Select Entities tab in the middle pane > Select an entity > clicl on the timeline card on the right pane > click on the plus sign on the right side of greyed shielded entities > add to exising or new incident. Not the most logical workflow, but it is what it is...
Tuitor01
👍 1
Therefore Answer: A
talosDevbot
👍 2
Selected: A
Sentinel > Incidents > open full details of an incident > select an entity (this will open the entity side panel which holds details about the entity) > click on the Timeline card > there's a plus sign symbol beside the alerts not included in the incident. Clicking that plus symbol will add that alert to the incident https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents#add-alerts-using-the-entity-timeline-preview
user636
👍 2
Selected: B
What a mess. Microsoft has changed the GUI in Sentinel. In the old GUI you can access the Timeline in the incident page. Ref: https://learn.microsoft.com/en-us/azure/sentinel/investigate-cases#how-to-investigate-incidents There is no "Timeline" tab available directly in Incidents pane in the new GUI. You need to open an Incident & then navigate to Entities tab & then select an entity and in the side pane select "Timeline" tab. Ref: https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents#add-alerts-using-the-entity-timeline-preview I'd go for the answer as B. A is anyways wrong, because there is no entity side panel of the Timeline card in Microsoft Sentinel. Rather there is the Timeline side panel of the Entities card in Microsoft Sentinel. :)
g_man_rap
👍 2
Selected: D
Option D: The Alerts page in the Microsoft 365 Defender portal This is where you can find and manage all alerts generated by Microsoft 365 Defender components, including Defender for Cloud Apps. From this portal, you can associate these alerts with existing incidents or create new incidents. This allows for a comprehensive view and management of security incidents across all Defender products.
smanzana
👍 1
A is correct
Sekpluz
👍 2
Selected: A
https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents#add-alerts-using-the-entity-timeline-preview
albatros06
👍 2
Selected: C
By using the investigation graph in Microsoft Sentinel, you can explore connections between the existing Microsoft 365 Defender data and potentially find the relevant Defender for Cloud Apps alert related to the incident you're investigating. T
DChilds
👍 3
Selected: D
The wording for option A, B and C makes me doubt them as answers because 1. The Timeline card does not have an entity side panel, it's actually the entity side panel that has a Timeline card tab. 2. The timelines tab is not on the incidents page of Sentinel and 3. The investigation graph is not on the incidents page but rather on the incident details panel. The Alert page in Defender 365 portal does allow you to associate an alert with an incident, so this would be my choice. Thought on this?
Ramye
👍 1
Selected: A
Answer confirmed by items 5 & 6 listed here https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents#add-alerts-using-the-entity-timeline-preview
kostask
👍 1
Selected: D
The question is tricky. If you read the following link you will see in limitations that you cannot link defender alerts to defender incidents from Sentinel. You can only do that from Defender portal. https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents#add-alerts-using-the-entity-timeline-preview
kostask
👍 1
Now that i thought it again, it says a link a defender for cloud app incident to a M365 Incident. and based on that you can do the following "You can add Microsoft Defender XDR alerts to non-Defender incidents, and non-Defender alerts to Defender incidents, in the Microsoft Sentinel portal." So A should be correct
ApexPredator84
👍 3
In the exam on 21/12/2023
Murtuza
👍 3
In the entity page side panel, select the Timeline card. A is the correct choice based on the links provided
shadowdark83
👍 4
Selected: A
Based on the documentation below, I think the aswer is A. https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents#add-alerts-using-the-entity-timeline-preview
kabooze
👍 14
Selected: A
It's A based on this: https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents#add-alerts-using-the-entity-timeline-preview other people say they get answer "b" out of this but i don't see it ....
Tuitor01
👍 2
In Incidents under Threat Management, pick an incident => View full details In the Incident details page, choose the Entities tab in the middle section of the screen. Choose an entity, on the right flying pane, choose the timeline cart For each events in the timeline you have a plus sign at the end that allows you to add this alert to an incident. Answer is therefore indeed A
danb67
👍 1
Selected: D
Changed my mind. This question has annoyed. I use Sentinel and A, B or C as worded in the question does not allow us to link to another incident. However D does. I have alerts in Sentinel that have been ingested from Defender. If I go to the alert in Defender I can 'link to another incident
danb67
👍 1
B based on https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents#add-alerts-using-the-entity-timeline-preview
danb67
👍 2
Changed my mind to A as the wording in B is strange and doesn't fit
IT_Nerd31
👍 5
The provided answer is correct. The article provided by a311 does illustrate how to do this, however, I believe that the instructions were misinterpreted. . Launch Sentinel . Go to incidents . Click on incident >> Investigate . In the middle pane you have the Overview tab and the Entities tab, click on Entities . Select one of the entities, and notice the blade that appears The options on this screen are, Info, Timeline, Insight. If you select timeline, you will see other alerts that you can add to the incident. B says the incident timeline, which are the alerts that are added to the incident. Now read A one more time: the entity side panel of the Timeline card in Microsoft Sentinel
nsss
👍 3
The article literally states you need to go to the entity side panel and then select a timeline card
a311
👍 6
Selected: B
Actually the correct answer is B. https://learn.microsoft.com/en-us/azure/sentinel/relate-alerts-to-incidents#add-alerts-using-the-entity-timeline-preview
kabooze
👍 4
If anything, that URL shows it's answer A
cris_exam
👍 3
Based on this article, I say B as well.
donathon
👍 1
D for me too
mali1969
👍 3
Selected: D
D. the Alerts page in the Microsoft 365 Defender portal. Open the Microsoft 365 Defender portal and select Alerts. Find the alert that you want to add to the incident and select it. In the alert details page, select Add to existing incident. In the Add alert to incident pane, select the incident that you want to update and then select Add. This will add the alert to the incident in both Microsoft 365 Defender and Microsoft Sentinel portals. Any changes you make to the incident in Microsoft 365 Defender will be synchronized to the same incident in Microsoft Sentinel
Fez786
👍 1
This new question arrived today 9th september 2023. Can someone please verify the correct answer?
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Microsoft Sentinel’s supported preview workflow for relating an alert to an incident is to open the incident, select Investigate, choose the relevant entity, and then use the Timeline card in the entity side panel. The Microsoft 365 Defender connector supplies Microsoft Defender for Cloud Apps alerts to the Sentinel workspace, so the alert can be selected there and added to the incident. This is exactly the function described by option A, not a generic incident timeline or portal alert list.Why the Other Options Are Wrong
Option B refers to a Timeline tab on the Sentinel incidents page, but the add-alert control is not a standalone incident-page timeline; it is surfaced through the entity side panel. Option C names the investigation graph, which is where you begin by selecting an entity, but the graph alone is not the add mechanism. Option D, the Alerts page in the Microsoft 365 Defender portal, lets you view Microsoft Defender for Cloud Apps alerts but does not update the Microsoft Sentinel incident with that alert.Community Comment Notes
Several learners, including kabooze and shadowdark83, followed the Microsoft Learn article and concluded that the entity timeline is the path; kabooze wrote “It's A based on this”. nsss summarized the same procedure by saying you need to “go to the entity side panel and then select a timeline card.” IT_Nerd31 argued that the quoted article was being misread, describing the Sentinel investigation view as an Entities tab leading to an entity blade, which is consistent with using the entity side panel rather than the incidents Timeline tab. The debate is mostly about imprecise UI wording, not a different technical workflow.Official Reference
Exam Strategy
When an SC-200 item asks how to add a related alert to a Sentinel incident, follow the Investigate > select entity > entity side panel > Timeline card path rather than choosing a page that only displays alerts. The exam often uses slightly imprecise UI labels, so focus on the functional location where the Add to incident action lives.
Frequently Asked Questions
Why is the Timeline tab on the Sentinel incidents page not the right option?
The supported preview workflow is not a standalone incident Timeline tab; it starts from the investigation graph, where you select an entity and open the Timeline card in the entity side panel.
Can I add the Defender for Cloud Apps alert from the Microsoft 365 Defender Alerts page?
The Defender portal can show the alert, but the requirement is to update the Microsoft Sentinel incident; that is done from the Sentinel entity timeline, not the Defender Alerts page.
Related Analysis
Practice All SC-200 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-200 Practice Test →