Skip to main content
The threat queue collects detections from Microsoft Defender, Microsoft Sentinel, Entra ID Protection, and Defender for Cloud Apps that need triage. Open it from Security > Threats.

​
What each detection shows

​
Quick views

Use quick views to find the right detections without building filters:
  • Open: everything still open or under investigation. This is the default view.
  • Assigned to me: detections assigned to you.
  • SLA at risk: open detections whose SLA expires in the next 60 minutes.
  • Overdue: detections that already breached their SLA.
  • Containment queue: detections under investigation where the recommended action is a containment step.
  • Closed this week: detections closed in the last 7 days, with the close reason.
A typical daily routine is SLA at risk, then Open, then Containment queue, then Closed this week.

​
Triage a detection

Click a row to open the detail panel. This is where you change the status, assignee, and comments.
1

Assign it

Pick an analyst from the assignee list. You can add a note when you reassign.
2

Update the status

Move the detection through Open, Investigating, Contained, and Closed. CtrlConnect records each change with the analyst, time, and reason.
3

Comment

Add comments and @mention colleagues to bring them in.
4

Escalate if needed

Click Escalate to raise the severity by one level, tighten the SLA, and flag the detection on the security dashboard watchlist.
5

Contain the threat

Click Contain to run the matching Microsoft 365 action: block sign-in, revoke sessions, quarantine a device, or force a password reset. The action is recorded on the detection.
To investigate further in Microsoft’s tools, use the Open in admin center button in the detail panel. It opens the product the detection came from.

​
Table tools

Like the other tables in CtrlConnect, the threat queue supports search, column filters, column visibility, row selection, and CSV or JSON export.