Understanding Security Incidents

Understanding security incidents

A security incident in Petra is a finding that something potentially harmful or suspicious has happened in one of your Microsoft 365 tenants—for example, a user's account may have been compromised, or they may have interacted with a phishing email. Understanding how incidents are created, what they represent, and how they're classified helps you triage and respond effectively.

What an incident represents

Each incident is tied to a specific user (identity) in a specific tenant and to a point in time. Petra analyzes sign-in data, email activity, and other Microsoft 365 signals to detect when something doesn't look right—such as a login from an unusual location, access to many emails in a short period, or evidence that a phish was opened. When that happens, Petra creates an incident and attaches details: what was detected, when it occurred, and which user and tenant are involved. You can open the incident to see a timeline, signals, and recommended next steps.

Severity and confidence

Incidents are labeled with a severity (for example, critical, high, or informational) to help you prioritize. Higher severity usually means the finding is more likely to be a real threat or has greater impact. Petra also assigns a confidence level (e.g., high, medium, low) to indicate how sure the system is that the finding is a true positive rather than a false alarm. Use both severity and confidence when deciding which incidents to handle first and how urgently to act.

Remediation status

As you work on an incident, you can update its remediation status. For example, you might mark it as remediated once you've locked the account and reset the password, or as incorrect if you determined it was a false positive. Tracking status helps your team see what's been handled and what's still open, and it helps Petra learn from your feedback. You can also add notes and record the actions you took (such as locking the account or notifying the user) so there's a clear audit trail.

Live vs. historical incidents

Some incidents are detected in near real time (live incidents) as data flows into Petra. Others are found during a look back—for example, when you run an Autopsy or when Petra processes historical data. Both types appear in your incident list; the main difference is when the threat occurred and when Petra detected it. For live incidents, you can often respond quickly; for historical ones, the report or incident view helps you understand what happened in the past and whether any follow-up is still needed.