Forum Discussion
Microsoft Sentinel Potentially malicious events and Incidents
#1
https://docs.microsoft.com/en-us/azure/sentinel/get-visibility#get-visualization
Potential malicious events: When traffic is detected from sources that are known to be malicious, Microsoft Sentinel alerts you on the map. If you see orange, it is inbound traffic: someone is trying to access your organization from a known malicious IP address. If you see Outbound (red) activity, it means that data from your network is being streamed out of your organization to a known malicious IP address.
The map is described above, but its only good if you are looking at it in the UI. When you click on the map (if you have data) you can see the query that is used.
Where as an Incident is based on a Analytic Rule that will initiate when the trigger that you define is encountered (maybe based on the map query?). If you create an Incident rule, it may only be needed for Inbound maliciousIP or a use case you are interested in - as it is the query is probably best for a visualisation rather than an Incident, which would typically require more tuning in the KQL to reduce the noise.
#2 your data is used, so maliciousIP is compared to your IP addresses seen in the (up to 6) data sources used.