Task 05: Investigate the incident with Attack Story

1. In the leftmost pane, select Investigation & response > Incidents & alerts > Incidents.

2. Select the incident: LAB - Password spray involving multiple users.

   

3. In the incident, select the Attack Story tab.

   

4. In the Incident graph, select the IP node and select IP details, review the information and then select Back to Incident details.

   

5. Scroll down to impacted mailboxes, select a user, and view alerts.