This workflow template enables security teams to quickly isolate or release devices from isolation with one click in response to a Quick Action execution. This process is essential for effective case management and endpoint detection and response (EDR) scenarios. The template waits for confirmation that the host has been successfully contacted before updating case notes with the action result, streamlining incident response and reducing the risk of spreading threats within the network environment.
Use Cases
Case Management , Endpoint Detection and Response (EDR)
Workflow Breakdown
Runs in response of a Quick Action execution.
Let the analyst choose between isolating or releasing a device.
Waits for the host to be contacted and confirm that the action has finished successfully.
Add a note to the case with the result of the action.
Vendors
Utils, Microsoft Defender for Endpoint, Torq Cases