How to Identify MITRE ATT&CK Phases in Microsoft Sentinel?
You have a Microsoft Sentinel workspace. You are investigating a multi-stage security attack on your environment. You need to identify the MITRE ATT&CK phases of the tactics and techniques used by the attacker. The solution must minimize administrative effort. What should you do?
Community Insight
The exam tests the dedicated Sentinel MITRE ATT&CK coverage view in the Defender portal; the trap is confusing it with the Hunting node or the Incidents node.
This SC-200 question tests how to identify MITRE ATT&CK tactics and techniques used in a Microsoft Sentinel attack investigation. The correct path is the MITRE ATT&CK node under Threat management in the Microsoft Defender portal, which minimizes administrative effort.
Choosing the Hunting node because hunting sounds like attacker behavior mapping; however, the Hunting node is for queries and bookmarks, not the MITRE ATT&CK coverage view.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The MITRE ATT&CK node under Threat management in Microsoft Sentinel within the Microsoft Defender portal is the dedicated view for reviewing tactics and techniques that detections map to. It presents current coverage so an analyst can identify the phases used in a multi-stage attack without building custom queries or spreadsheets. This directly satisfies the requirement to minimize administrative effort because coverage is generated from Sentinel analytics rules and their MITRE mappings. Staim voted for this option and linked Microsoft's official MITRE coverage article, which supports using the Defender portal MITRE view.Why the Other Options Are Wrong
The Microsoft Security Compliance Toolkit is for Windows security baselines and policy comparison, not Sentinel ATT&CK mapping. The Incidents node under Investigation & response is for triaging alerts and incidents, and it does not provide the full tactic and technique coverage matrix. The Hunting node is for running advanced hunting queries, bookmarks, and livestream, not for the dedicated MITRE ATT&CK coverage view; choosing it adds administrative effort.Community Comment Notes
Staim recorded a vote for A and supplied the official Microsoft Sentinel MITRE coverage documentation link. That reference describes viewing current MITRE coverage in the Defender portal, aligning with the Threat management > MITRE ATT&CK path. No commenter argued for the Security Compliance Toolkit or the Incidents node. The available community evidence therefore supports the direct MITRE ATT&CK view rather than hunting queries.Official Reference
Exam Strategy
When a Sentinel question asks for MITRE ATT&CK tactics or techniques, look for the Threat management > MITRE ATT&CK path rather than hunting queries or incident triage. Eliminate the Compliance Toolkit immediately because it is unrelated to Sentinel detection mapping.
Frequently Asked Questions
Why is the Hunting node not the right choice for MITRE ATT&CK phases?
The Hunting node is for running advanced hunting queries and bookmarks; it does not present the dedicated MITRE ATT&CK coverage matrix that Threat management provides.
Does the Incidents node show attacker tactics and techniques?
Incidents group alerts for triage, but the dedicated MITRE ATT&CK node is the view that maps detections to tactics and techniques with minimal effort.
Related Analysis
Practice All SC-200 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-200 Practice Test →