The "QuickAction - Fetch a File from Device on MS Defender Endpoint" workflow template is designed to streamline the process of retrieving suspicious files from endpoints using Microsoft Defender for Endpoint. This workflow is particularly useful for security operations centers (SOCs) engaged in threat hunting and case management. It automates the fetching of files, compresses them into password-protected archives, and attaches them to cases for further analysis, enhancing threat intelligence enrichment and incident response efficiency.
Use Cases
Case Management , Threat Hunting , Threat Intelligence Enrichment
Workflow Breakdown
Fetch a File from Device on MS Defender Endpoint
Replace Gzip archive with Password Protected Zip archive using a predefined password
Attach to case
Vendors
Scripting, Utils, HTTP, Microsoft Defender for Endpoint, Torq Cases