This workflow template facilitates the isolation or reintegration of devices within a network, employing Microsoft Defender for Endpoint. It enables security teams to quickly isolate a device by using its machine ID or computer DNS name, prevent potential threats from spreading, and ensure the security of network assets. The workflow waits for a specified duration to confirm successful execution and records all related actions for thorough incident response and analysis. This workflow is essential for proactive Endpoint Detection and Response (EDR) measures, ensuring network integrity through immediate containment of suspect devices.
Optional Triggers
"This workflows is intended to be used as a function."
Use Cases
Endpoint Detection and Response (EDR)
Workflow Breakdown
Takes as an input machineId or computerDnsName values.
Submits Isolate or Unisolate action to device by it's machineId.
Workflow will wait an specified period of time to verify the action is successful applied by Endpoint.
Collects a list of previous Isolate or Unisolate actions.
Vendors
Utils, Microsoft Defender for Endpoint
Workflow Output
Summary of status of the action.