You have a Microsoft Sentinel workspace named SW1.
In SW1, you investigate an incident that is associated with the following entities:
* Host
* IP address
* User account
* Malware name
Which entity can be labeled as an indicator of compromise (loC) directly from the incident s page?

Question

You have a Microsoft Sentinel workspace named SW1.

In SW1, you investigate an incident that is associated with the following entities:

* Host

* IP address

* User account

* Malware name

Which entity can be labeled as an indicator of compromise (loC) directly from the incident s page?

ben ebrahimi · Accepted Answer

<div style="font-size:12pt;font-family:Calibri, sans-serif;"><p style="margin:0;"> IP address</p></div>

ben ebrahimi · Answer

malware name

ben ebrahimi · Answer

ben ebrahimi · Answer

user account

List of questions