The "QuickAction - Isolate or Release a Device on MS Defender Endpoint" workflow template is designed to enhance security operations by allowing SOC analysts to quickly isolate or release devices using Microsoft Defender for Endpoint. Triggered by a Quick Action, this workflow provides a user-friendly interface for analysts to decide on isolating a suspicious device or releasing a remediated one. It ensures efficient case management by automatically adding action results as notes to the relevant case, streamlining incident response and documentation.
Use Cases
Case Management , Endpoint Detection and Response (EDR)
Workflow Breakdown
Runs in response of a Quick Action execution.
Let the analyst choose between isolating or releasing a device.
Waits for the host to be contacted and confirm that the action has finished successfully.
Add a note to the case with the result of the action.
Vendors
Utils, Microsoft Defender for Endpoint, Torq Cases