Review remediation actions following an automated investigation (Microsoft)

Remediation actions

When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be Malicious, Suspicious, or No threats found.

Depending on

• the type of threat,
• the resulting verdict, and
• how your organization’s device groups are configured,

remediation actions can occur automatically or only upon approval by your organization’s security operations team.

Here are a few examples:

• Example 1: Fabrikam’s device groups are set to Full – remediate threats automatically (the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious following an automated investigation (see Review completed actions).
• Example 2: Contoso’s devices are included in a device group that is set for Semi – require approval for any remediation. In this case, Contoso’s security operations team must review and approve all remediation actions following an automated investigation (see Review pending actions).
• Example 3: Tailspin Toys has their device groups set to No automated response (not recommended). In this case, automated investigations do not occur. No remediation actions are taken or pending, and no actions are logged in the Action center for their devices (see Manage device groups).

Whether taken automatically or upon approval, an automated investigation can result in one or more of the remediation actions:

• Quarantine a file
• Remove a registry key
• Kill a process
• Stop a service
• Disable a driver
• Remove a scheduled task

Review pending actions

1. Go to the Microsoft 365 Defender portal and sign in.
2. In the navigation pane, choose Action center.
3. Review the items on the Pending tab.
4. Select an action to open its flyout pane.
5. In the flyout pane, review the information, and then take one of the following steps:
   • Select Open investigation page to view more details about the investigation.
   • Select Approve to initiate a pending action.
   • Select Reject to prevent a pending action from being taken.
   • Select Go hunt to go into Advanced hunting.

Review completed actions

1. Go to the Microsoft 365 Defender portal and sign in.
2. In the navigation pane, choose Action center.
3. Review the items on the History tab.
4. Select an item to view more details about that remediation action.

Undo completed actions

If you’ve determined that a device or a file is not a threat, you can undo remediation actions that were taken, whether those actions were taken automatically or manually. In the Action center, on the History tab, you can undo any of the following actions:

To undo multiple actions at one time

1. Go to the Action center (https://security.microsoft.com/action-center) and sign in.
2. On the History tab, select the actions that you want to undo. Make sure to select items that have the same Action type. A flyout pane opens.
3. In the flyout pane, select Undo.

To remove a file from quarantine across multiple devices

1. Go to the Action center (https://security.microsoft.com/action-center) and sign in.
2. On the History tab, select an item that has the Action type Quarantine file.
3. In the flyout pane, select Apply to X more instances of this file, and then select Undo.

Automation levels, automated investigation results, and resulting actions

Automation levels affect whether certain remediation actions are taken automatically or only upon approval. Sometimes your security operations team has more steps to take, depending on the results of an automated investigation. The following table summarizes automation levels, results of automated investigations, and what to do in each case.

In Microsoft Defender for Endpoint, all verdicts are tracked in the Action center.

Source : Official Microsoft Brand
Editor by : BEST Antivirus KBS Team