The "QuickAction - Scan Device on MS Defender for Endpoint" workflow template is designed to enhance incident response efficiency by automating malware scans on remote devices. Triggered by a Quick Action, it initiates a comprehensive malware scan using Microsoft Defender for Endpoint, ensuring swift threat detection and mitigation. The workflow also updates the case with scan results, streamlining case management and bolstering endpoint detection and response (EDR) capabilities.
Use Cases
Case Management , Endpoint Detection and Response (EDR)
Workflow Breakdown
Runs in response of a Quick Action execution.
Starts a full malware scan on the remote device.
Waits for the host to be contacted and confirm that the action has finished successfully.
Add a note to the case with the result of the action.
Vendors
Utils, Microsoft Defender for Endpoint, Torq Cases