On the Microsoft Defender (Microsoft 365 Defender) Incident page, investigators need a complete view of what actions were taken and when. The UI provides multiple panes to support that: the Tasks area (lists manual and automated investigation/remediation tasks assigned to the incident), the Activity log (chronological audit of user and system actions taken on the incident such as assignments, status changes, playbook runs and remediation actions), and the Alert timeline (a timeline view showing the alerts that make up the incident and the sequence of alerts and related detections/events). Microsoft's investigation guidance describes all three surfaces as part of the incident investigation workflow: tasks capture work items and owner actions, the activity log provides an auditable history of actions and changes, and the alert timeline visualizes the alert and event sequence that drove the incident. Because the question asks specifically for reviewing the incident tasks that were performed , the incident page exposes the tasks list and also the activity log and alert timeline so you can see when tasks ran, who ran them, what automated playbooks or remediation executed, and how those tasks related to the underlying alerts. For full incident forensics and auditability you use Tasks
+ Activity log + Alert timeline .