Respond to Microsoft Defender for Endpoint Alerts

Bundled into the existing Microsoft Certified: Security Operations Analyst Associate premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

Action	Goal	What it does	Key prerequisite/limit
Isolate device	Contain	Cuts network access but keeps the Defender for Endpoint service connection alive; full or selective	Needs the Active remediation actions role and device-group access; retries up to 3 days if offline
Restrict app execution	Contain	Applies a WDAC code-integrity policy so only Microsoft-signed code runs	Windows 10 1709+ with Defender Antivirus; reversible
Contain device	Contain	Onboarded devices block all traffic to/from a compromised unmanaged device	Target need not be onboarded; enforced by onboarded Windows devices
Collect investigation package	Collect	Downloads a zip of forensic artifacts (autoruns, processes, services, network, more)	Available from the device page; downloaded from Action center
Run antivirus scan	Remediate	Triggers a remote quick or full Defender Antivirus scan	CPU capped (default 50%) during the scan
Live response	Investigate + remediate	Remote shell to run commands, pull files, run scripts, remediate entities	Enabled in advanced settings; basic vs advanced commands are RBAC-gated

Cheat sheet

Read the device timeline before taking any response action
Device timeline shows 30 days by default but retains data for 90
Hunt for related events pivots a single event into advanced hunting
Isolating a device keeps the Defender for Endpoint sensor connected
Selective isolation can keep Outlook and Teams reachable
Isolation needs the Active remediation actions role and device-group access
Restrict app execution applies a WDAC policy for Microsoft-signed code only
Contain device is for compromised devices that are not onboarded
Collect the investigation package to capture forensics without changing the device
Live response is an RBAC-gated remote shell you enable in advanced features
Basic vs advanced live response commands are separate RBAC grants
Scripts must be in the live response library before run can call them
Live response limits: 1 per device, 5 per user, 50 tenant-wide, 30-min idle
getfile and putfile have platform-specific size limits
Ctrl+C in live response cancels the portal view, not the agent action
Evidence and Response marks each entity Malicious, Suspicious, or Clean
Go hunt finds an entity everywhere else in the estate
Every device response action is recorded in the Action center
Investigation-package collection: role, download URI, in-flight limit, and failure causes

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet