---
name: Defender Incident Hygiene Review
description: Read-only review of Microsoft Defender XDR incidents for unassigned, ageing or improperly suppressed items to summarise response hygiene.
---

# Defender Incident Hygiene Review

> **TL;DR:** This skill inspects your Microsoft Defender XDR incident queue and reports which incidents are unassigned, ageing past target times, or suppressed without justification, so your team can fix response gaps.

## What is the Microsoft Defender XDR incident queue?

Microsoft Defender XDR correlates related alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps into a single incident queue in the Microsoft Defender portal. Each incident carries an owner, severity, status, classification and tags that drive your security operations workflow. When incidents sit unassigned, age without progress, or are resolved or suppressed without a documented determination, your detection and response posture quietly degrades. This skill reads that queue and surfaces those hygiene gaps for review.

## When should you run this skill?

- "Show me which Defender incidents have no owner assigned."
- "Are there any ageing incidents that have been open too long?"
- "Which incidents were resolved or suppressed without a classification?"
- "Give me a hygiene summary of our Defender XDR incident queue."
- "Audit our incident response before the monthly security review."
- "Find high-severity incidents that have stalled in our queue."
- "Check whether any incidents were closed as false positive without a reason."

## How this skill works, step by step

1. Connect read-only to the Microsoft Defender portal incident data and retrieve the current incident queue.
2. Read each incident's owner, severity, status, classification, determination, creation time and last update time without modifying any field.
3. Flag incidents with no assigned owner, since unassigned items lack accountability.
4. Flag active incidents whose age since creation exceeds your target response window, weighting by severity so high-severity ageing incidents rank highest.
5. Flag incidents marked resolved, suppressed or closed as a false positive that carry no classification or determination, indicating an improperly closed item.
6. Read incident tags and comments to identify whether a documented justification exists for each closure or suppression.
7. Derive a hygiene risk score per incident by combining severity, age beyond target, missing ownership and missing justification into a single weighted value.
8. Aggregate the scored incidents into an overall queue hygiene rating and a prioritised list of items to remediate.
9. Present the findings as a table and summary, with no changes written back to any incident.

## Output format

The skill returns a table of flagged incidents ranked by hygiene risk, followed by a short summary.

| Incident ID | Severity | Status | Owner | Age (days) | Hygiene issue | Risk |
| --- | --- | --- | --- | --- | --- | --- |
| INC-4821 | High | Active | Unassigned | 9 | No owner; ageing past 3-day target | Critical |
| INC-4756 | Medium | Resolved | a.singh | 14 | Closed with no classification or determination | High |

- Total incidents reviewed and the count flagged for hygiene issues.
- Breakdown by issue type: unassigned, ageing, and improperly suppressed or resolved.
- Highest-risk incidents requiring immediate attention.
- Overall queue hygiene rating with a one-line recommendation.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Microsoft Defender XDR incident queue | Microsoft 365 E5 or Microsoft 365 E5 Security add-on |
| Defender for Endpoint incident correlation | Microsoft Defender for Endpoint Plan 2 |

### Least-privilege roles

- Security Reader (read-only visibility of incidents and alerts)
- Global Reader (read-only tenant-wide visibility where broader context is needed)

### Microsoft Graph permissions (read-only)

- `SecurityIncident.Read.All` - reads Microsoft Defender XDR incidents, their owners, status, classification and timestamps.
- `SecurityAlert.Read.All` - reads the alerts correlated into each incident for severity and context.

## Scope and safety

This skill is read-only by default and never changes incident state, ownership, classification or suppression rules.

This skill does NOT:

- Assign, reassign, resolve, suppress or reopen any incident.
- Create, edit or delete suppression or automation rules.
- Take response actions such as isolating devices or removing email.
- Write tags, comments or classifications back to any incident.

## Sources and compliance

- [Incidents and alerts in the Microsoft Defender portal](https://learn.microsoft.com/en-us/defender-xdr/incidents-overview)
- [Manage incidents in Microsoft Defender](https://learn.microsoft.com/en-us/defender-xdr/manage-incidents)
- Supports the "Regular review" intent behind Essential Eight monitoring and response practices; see the [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model).
- Aligns with ISM guidance on detecting and responding to cyber security incidents in a timely manner.
- Output in Australian English.