> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ctrlconnect.nl/llms.txt
> Use this file to discover all available pages before exploring further.

# Triage threats in the threat queue

> Work through Microsoft 365 security detections: filter with quick views, track SLAs, assign analysts, escalate, and run containment actions.

The threat queue collects detections from Microsoft Defender, Microsoft Sentinel, Entra ID Protection, and Defender for Cloud Apps that need triage. Open it from **Security** > **Threats**.

## What each detection shows

| Field | Description |
| - | - |
| **Severity** | Critical, High, Medium, or Low. |
| **Category** | Account compromise, Phishing, Malware, Data exfiltration, Insider risk, Lateral movement, Misconfiguration, or Anomalous sign-in. |
| **Status** | Open, Investigating, Contained, or Closed. |
| **Assignee** | The analyst working on it. Unassigned detections are marked clearly. |
| **SLA** | The target close time, with a live countdown. Breached SLAs turn red. |
| **Source** | The Microsoft product the detection came from. |

## Quick views

Use quick views to find the right detections without building filters:

* **Open**: everything still open or under investigation. This is the default view.
* **Assigned to me**: detections assigned to you.
* **SLA at risk**: open detections whose SLA expires in the next 60 minutes.
* **Overdue**: detections that already breached their SLA.
* **Containment queue**: detections under investigation where the recommended action is a containment step.
* **Closed this week**: detections closed in the last 7 days, with the close reason.

> [!TIP]
>
> A typical daily routine is **SLA at risk**, then **Open**, then **Containment queue**, then **Closed this week**.

## Triage a detection

Click a row to open the detail panel. This is where you change the status, assignee, and comments.

**1. Assign it**

Pick an analyst from the assignee list. You can add a note when you reassign.

**2. Update the status**

Move the detection through **Open**, **Investigating**, **Contained**, and **Closed**. CtrlConnect records each change with the analyst, time, and reason.

**3. Comment**

Add comments and @mention colleagues to bring them in.

**4. Escalate if needed**

Click **Escalate** to raise the severity by one level, tighten the SLA, and flag the detection on the security dashboard watchlist.

**5. Contain the threat**

Click **Contain** to run the matching Microsoft 365 action: block sign-in, revoke sessions, quarantine a device, or force a password reset. The action is recorded on the detection.

To investigate further in Microsoft's tools, use the **Open in admin center** button in the detail panel. It opens the product the detection came from.

## Table tools

Like the other tables in CtrlConnect, the threat queue supports search, column filters, column visibility, row selection, and CSV or JSON export.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.