Run MDE Antivirus - Incident Triggered

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This playbook will run a antivirus (full) scan on the machine in Microsoft Defender for Endpoint. It is triggered by an incident creation in Microsoft Sentinel. The playbook will look for the host entities in the incident and run a scan on the machine in MDE. If the host is not found in MDE, it will add a comment to the incident.

Attribute Value
Type Playbook
Solution MicrosoftDefenderForEndpoint
Source View on GitHub

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Playbooks · Back to MicrosoftDefenderForEndpoint