The "Fetch File Information by Hash from Microsoft Defender" workflow template is designed for businesses utilizing Endpoint Detection and Response (EDR) solutions. It enables users to gather comprehensive threat intelligence on a specific file by its SHA1 hash within a defined timeframe. The workflow collects and summarizes file metadata, related devices, and alerts, providing insights into potential threats, malware families, and security verdicts, enhancing incident response capabilities.
Optional Triggers
["This workflow is intended to be used as a function."]
Use Cases
Endpoint Detection and Response (EDR) , Function
Workflow Breakdown
Takes as an input fileId (SHA1 Hash) value and a time frame.
Collects File Metadata, related devices and related alerts.
Filters and Summarize collected data.
Vendors
Utils, Microsoft Defender for Endpoint
Workflow Output
Summary on file metadata, MITRE TTPs, related devices, related threats, malware family and verdict.