While looking into the device timeline for suspicious activity, we can search and filter for specific events. We can set event flags by:
- Highlighting the most important events
- Marking events that require a deep dive
- Building a clean breach timeline
Find the event that we want to flag. Select the flag icon in the Flag column.
Once events are flagged, we can filter suspicious events more easily. In the timeline Filters section, enable Flagged events. Only flagged events are displayed. You can apply more filters that will only show events prior to the flagged event.
Reference:
https://docs.microsoft.com/en-us/defender-for-identity/investigate-entity