Real-time response with device, file, and user actions
Earlier in this chapter, we explored responding to incidents. Let’s now explore, in more depth, some of the actions we can perform in the Microsoft 365 Defender portal. We can break these down into three response action types: device, file, and user.
Device response actions
To respond to investigations, incidents, and threats, an administrator can invoke the following types of response actions to an onboarded device from the Device page or any reference to a device in the investigation and alert interfaces. Let’s check out the full list before exploring the key ones in more detail:
- Run Antivirus Scan
- Collect Investigation Package
- Restrict App Execution
- Initiate Automated Investigation
- Initiate Live Response Session
- Isolate Device
There are others that are a bit more intuitive and, therefore, we’ll skip over them (such as Exclude and Report device inaccuracy), and you...
