The "QuickAction - Fetch a File from Device on MS Defender Endpoint" workflow template provides a streamlined process for security analysts to swiftly retrieve files from a device using Microsoft Defender for Endpoint. Upon triggering a quick action, the workflow fetches the specified file, converts it from Gzip to a password-protected Zip archive with a predefined password, and attaches it to the relevant case. Ideal for case management and enhancing threat hunting and intelligence enrichment, it ensures secure handling and documentation of potentially malicious files within forensic investigations.

Case Management , Threat Hunting , Threat Intelligence Enrichment

Scripting, Utils, HTTP, Microsoft Defender for Endpoint, Torq Cases