In Microsoft Sentinel, analysts manage and investigate incidents through the Incident page, which provides multiple investigation and triage tools. The two core aspects of incident analysis relevant here are entity visualization and investigation audit tracking.

Entity Map (Investigate):

Selecting Investigate opens the Investigation Graph view in Microsoft Sentinel.

This interactive map visually displays all the entities (users, IPs, hosts, accounts, files, etc.) related to the alert and their relationships.

It helps analysts understand how alerts are connected, uncover lateral movements, and explore correlated suspicious activities.

Microsoft documentation describes this as:

“The investigation graph provides a visual representation of the entities involved in the incident, showing relationships between them to aid root-cause analysis.”

Hence, to view a map of connected entities, choose Investigate.

Investigation Activities (Comments):

The Comments tab tracks the activities and analyst notes during the incident lifecycle.

This includes changes to status, assignments, and documented investigation steps — essentially functioning as an activity log for the incident.

Microsoft’s official Sentinel documentation states:

“The Comments section in the incident pane provides a timeline of analyst interactions, investigation notes, and changes performed on the incident.”

Therefore, to view the list of investigation activities, select Comments.