# Attack Chains An attack rarely produces a single incident. The same attacker can trigger an alert on a device, then a suspicious sign-in, then a change to a mailbox: Microsoft Defender XDR and Microsoft Sentinel report them as separate incidents. CyberGuard links the incidents that share accounts, devices, IP addresses or other evidence into one **attack chain**, so you can read the whole story in one place. You open an attack chain from the [incident list](https://wiki.cyberguard.srl/cat/microsoft-security-view/incidents.md): the incidents that belong to a chain show **Part of a chain of N incidents** below their title. ## Overview  At the top of the page: - **Open in Defender** opens the main incident of the chain in the Microsoft Defender portal; **Back** returns to the incident list; - the indicators count the incidents, alerts, MITRE ATT&CK techniques, accounts and devices involved; - the **Summary** card shows the incident that opened the chain, its status, severity and priority, the period of the attack, the services involved, the assignee, the classification and the external IP addresses involved; - **What happened** sums up the chain and shows **how far the attack reached**: delivery, execution, endpoint, identity and impact. The phases in red have been reached. ## Attack Techniques  The techniques reported by the alerts of the chain are arranged by MITRE ATT&CK tactic, in the order of the attack. Each card shows the technique, its name, the highest severity and how many alerts report it.  Click a technique to open its details on the right: the tactics it belongs to, its description, the link to the official MITRE ATT&CK page, the sub-techniques observed and the alerts of the chain that report it. ## Timeline, Entities and Response Below the techniques: - **Timeline** — every event of the chain in order of time: when each incident was created and updated, when each alert started and when it was resolved. - **Involved entities** — accounts, devices, files, IP addresses and the other evidence of the alerts, with their role (for example source or destination) and the verdict of Defender. - **Response** — the alerts still to be handled, with the **recommended actions** of Microsoft, and the ones already resolved. Long recommendations are shortened to two lines: click the arrow to read them in full.  - **Incidents and links** — the incidents of the chain and why they are linked (the same account, device or IP address), with the button to open each one in Defender.