The "QuickAction - Fetch a File from Device on MS Defender Endpoint" workflow template is designed to streamline case management and enhance threat hunting and intelligence enrichment. It allows SOC analysts to efficiently retrieve suspicious files from endpoints using Microsoft Defender for Endpoint. The workflow automates the process of fetching files, securing them in password-protected archives, and attaching them to cases, ensuring secure handling and documentation of potential threats.
Use Cases
Case Management , Threat Hunting , Threat Intelligence Enrichment
Workflow Breakdown
Fetch a File from Device on MS Defender Endpoint
Replace Gzip archive with Password Protected Zip archive using a predefined password
Attach to case
Vendors
Scripting, Utils, HTTP, Microsoft Defender for Endpoint, Torq Cases