This workflow template expedites cybersecurity response by automating full malware scans on remote devices through Microsoft Defender for Endpoint. It launches upon a Quick Action execution, ensuring that devices under investigation are promptly scanned. The workflow waits for scan completion confirmation, then records the results in the case file. Essential for case management and EDR, this template enhances incident response efficiency and documentation.
Use Cases
Case Management , Endpoint Detection and Response (EDR)
Workflow Breakdown
Runs in response of a Quick Action execution.
Starts a full malware scan on the remote device.
Waits for the host to be contacted and confirm that the action has finished successfully.
Add a note to the case with the result of the action.
Vendors
Utils, Microsoft Defender for Endpoint, Torq Cases