Domain 2 of 3 · Chapter 2 of 3

Respond to alerts and incidents in Microsoft Defender for Endpoint

Unlock the complete study guide + 25 practice exams totaling 1,498 questions.

Bundled into the existing Microsoft Certified: Security Operations Analyst Associate premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Where endpoint evidence lives
  • Working the device timeline
  • Interpreting timeline evidence
  • Collecting an investigation package
  • Reading investigation package artifacts
  • Live response prerequisites
  • Running live response commands
  • Live response constraints
  • Investigating a file entity
  • Investigating other evidence entities
  • Investigating an internet-facing device
  • File response actions
  • Two containment models
  • Isolating a device
  • Device actions beyond isolation
  • Peer-enforced containment actions
  • Investigating an attack disruption incident
  • Hunting containment effects with KQL
  • Why a response action is missing or skipped
  • Practice: choosing Defender for Endpoint investigation tools and response actions

Containment actions that block communication: Isolate device vs Contain device vs Contain IP vs Contain user

QuestionIsolate deviceContain deviceContain IPContain user
What is targetedA compromised onboarded deviceAn unmanaged device (discovered, not onboarded)The IP address of an undiscovered or non-onboarded deviceA compromised user identity
Who enforces the blockThe isolated device itselfEvery supported onboarded deviceEvery supported onboarded deviceEvery supported onboarded device
How it startsManually, or by attack disruption (preview, workstations only)Manually, or by attack disruptionOnly by attack disruptionAutomatically by attack disruption or predictive shielding (a related preview feature that applies protections before an attack escalates)
What gets blockedThe device's network traffic, except the Defender for Endpoint service and any selective isolation exclusionsIncoming and outgoing communication with the contained deviceIncoming and outgoing traffic with devices using that IP addressIncoming network logons, RPC, SMB, and RDP from the user; attack disruption ends existing remote sessions, while predictive shielding prevents new sessions
How it endsRelease from isolation (or a force-release script if the device is unresponsive), or automatically after seven days (automatic isolation: after a defined time window)Release from containmentUndo on the Contain IP action in the Action centerUndo in the Action center or user pane; when applied by attack disruption, automatically within five days
Watch out forA full-tunnel VPN or web proxy can break the device's path backPeers can take up to 5 minutes to receive the policy; check BFE on enforcing devicesNo device-local action exists for the source; peers do all the blockingThe account is not disabled in the identity provider

Decision tree

Is the threat auser identity?YesNoContain user(automatic only)Is the sourcedevice onboarded?YesNoMust chosendestinationsstay reachable?Was the devicediscovered?YesNoYesNoSelectiveisolationFullisolationContaindeviceContainIP(automaticonly)Attack disruption: check Policy statusRelease only after investigating
Cheat sheet

Cheat sheet

  • Flagged events create a focused breach timeline
  • Timeline exports have a narrower date window than the default display
  • The timeline process tree explains parent-child execution relationships
  • Hunting from a technique returns the supporting events rather than the technique row
  • Firewall timeline evidence depends on the relevant audit policy
  • EDR critical mode can temporarily stop processing new endpoint events
  • Timeline additional information distinguishes detection from successful enforcement
  • Hunting from an ordinary timeline event retrieves nearby endpoint activity
  • An investigation package captures current device state for forensic review
  • The collection summary distinguishes missing evidence from collection failure
  • Autoruns artifacts expose registered startup persistence
  • Prefetch can preserve traces of applications no longer present
  • SMB session artifacts help investigate lateral movement and exfiltration
  • Battery and network conditions can prevent package collection
  • Network artifacts distinguish process connections from cached network context
  • Scheduled persistence and dropped payloads leave different package evidence
  • Audited sign-ins and group membership require different package artifacts
  • Investigation package contents depend on the endpoint operating system
  • Live response investigates the endpoint interactively rather than only querying stored telemetry
  • Live response separates investigative commands from advanced response authority
  • Unsigned PowerShell execution requires an explicit live response setting
  • Live response concurrency is constrained at tenant, analyst, and device levels
  • Live response command deadlines differ from the idle-session timeout
  • The live response command log records what the responder actually ran
  • Live response separates evidence retrieval, library deployment, and remediation
  • Canceling a live response command in the portal does not halt endpoint execution
  • Background file downloads let live response investigation continue
  • Live response commands and rollback support differ across platforms
  • A supported file size can still exceed the available transfer time
  • Device isolation blocks normal network access while preserving Defender connectivity
  • A full-tunnel VPN can interrupt management of an isolated device
  • An offline isolation request is retried for a limited period
  • Isolating a Hyper-V host also blocks its child virtual machines' traffic
  • Restrict app execution permits only files signed by a Microsoft-issued certificate
  • A remote Defender Antivirus scan can run while another antivirus is primary
  • Selective isolation preserves required paths while retaining containment
  • An unresponsive isolated Windows device has a device-specific recovery script
  • Unavailable device actions can reflect support constraints or restricted onboarding
  • Entity links connect alert evidence to a file's detailed investigation page
  • Organizational file prevalence is limited by the analyst's device visibility
  • A file's observed-device list distinguishes presence from execution
  • The File names tab reveals names used by the same investigated file
  • File content and capability details depend on Microsoft analysis
  • Cloud-app file observations require the Defender for Cloud Apps workload
  • Internet-facing detection identifies an exposure path to investigate
  • File cleanup and sandbox investigation require different profile actions
  • File reputation and observation windows must be interpreted in context
  • Device containment blocks the suspicious device through protected endpoints
  • Contain IP can protect endpoints from a device that is not onboarded
  • A completed disruption action is not proof that its policy remains active
  • Containment events in DeviceEvents describe blocked activity rather than initial containment
  • DisruptionAndResponseEvents provides cross-incident visibility of enforcement outcomes and policy applications
  • Containment should be released only after investigation and risk mitigation
  • Attack-disruption user containment terminates remote activity and expires automatically
  • Automatic isolation must be verified against device state and exclusion outcomes
  • Critical-asset containment restricts attack paths while preserving essential services
  • Containment troubleshooting must account for propagation, address sharing, and BFE

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. https://learn.microsoft.com/en-us/defender-endpoint/investigate-alerts
  2. https://learn.microsoft.com/en-us/defender-endpoint/investigate-machines
  3. https://learn.microsoft.com/en-us/defender-endpoint/respond-machine-alerts
  4. https://learn.microsoft.com/en-us/defender-endpoint/investigate-files
  5. https://learn.microsoft.com/en-us/defender-endpoint/investigate-ip
  6. https://learn.microsoft.com/en-us/defender-xdr/incidents-overview
  7. https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview
  8. https://learn.microsoft.com/en-us/defender-endpoint/machine-groups
  9. https://learn.microsoft.com/en-us/defender-endpoint/live-response
  10. https://learn.microsoft.com/en-us/defender-endpoint/advanced-features
  11. https://learn.microsoft.com/en-us/defender-endpoint/user-roles
  12. https://learn.microsoft.com/en-us/defender-xdr/custom-permissions-details
  13. https://learn.microsoft.com/en-us/defender-xdr/m365d-action-center
  14. https://learn.microsoft.com/en-us/defender-endpoint/restrict-response-actions-high-value-assets
  15. https://learn.microsoft.com/en-us/defender-endpoint/investigate-user
  16. https://learn.microsoft.com/en-us/defender-endpoint/investigate-domain
  17. https://learn.microsoft.com/en-us/defender-endpoint/respond-file-alerts
  18. https://learn.microsoft.com/en-us/defender-xdr/automatic-attack-disruption
  19. https://learn.microsoft.com/en-us/defender-endpoint/network-isolation-exclusions
  20. https://learn.microsoft.com/en-us/defender-xdr/autoad-results
  21. https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-disruptionandresponseevents-table
  22. https://learn.microsoft.com/en-us/defender-xdr/automatic-attack-disruption-exclusions