Unisolate MDE Machine - Incident Triggered

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This playbook will release a machine from isolation in Microsoft Defender for Endpoint. It is triggered by an incident creation in Microsoft Sentinel. The playbook will search for the host entity in the incident and then search for the machine in Microsoft Defender for Endpoint. If the machine is found, it will be unisolated.

Attribute Value
Type Playbook
Solution MicrosoftDefenderForEndpoint
Source View on GitHub

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Playbooks · Back to MicrosoftDefenderForEndpoint