When triaging or investigating an incident, the context of the entirety of incidents in your SOC can be extremely useful. Other incidents involving the same entities for example can represent useful ...
Updated May 15, 2022
Version 1.0
Blog Post
Talking about what's new, I noticed a very unpleasant surprise this morning, when working with Sentinel.
Sentinel used to have a very good and easy way to navigate the interface, where you could investigate an incident (View Full Details > Alert ID or events, etc.), and you wouldn't loose previous information and the previous screens, as you could scroll to the sides. This was a huge navigational help, as I did not need to refresh pages, exit my investigation, and I could easily compare existent tickets just by scrolling to the left.
For some reason this functionality vanished today. Life is a lot harder now that I don't have all the necessary data loaded in the same screen. Not sure why Microsoft arbitrarily chooses to make our lives a little harder.
Is there a way this could roll back to how it was yesterday?
On the same note, in the AAD, when checking sign in logs for users, clicking on a log would bring the related details in the bottom of the screen. This was very good, because I could still see the other logs above. Later, this changed to load the info to to the right of the screen, being on the way of a good chunk of the logs, so we cannot easily compare the current expanded information with the other log lines. Could this be rolled back also?
Thanks,
Vitor