Use “Isolate a Microsoft Defender endpoint machine” in Recued. It runs the Microsoft Defender for Endpoint machine isolation workflow for one machine with approval before changes are made.

How it works 9 steps

Inspect the data fetches, transforms, gates, and output this recipe runs.

Process (9 steps)

■ machine_id trim

Trim whitespace from setting machine id

■ comment trim

Trim whitespace from setting comment

◆ machine_before recued-core.microsoft-defender-endpoint.machine.read

Read machine on microsoft defender endpoint

◆ alerts_raw recued-core.microsoft-defender-endpoint.machine.alert.search

Search machine alert on microsoft defender endpoint

◆ isolate recued-core.microsoft-defender-endpoint.machine.isolate

Isolate machine on microsoft defender endpoint

■ alerts default

Apply default

■ alert_count count

Count items in alerts

■ card to_summary

Format results as a summary card

■ alerts_table to_table

Format results as a data table

▼

Output

summary card

table alerts_table

Settings 3 configurable

Configurable at install. Defaults shown — change them anytime in Recued.

comment setting = Isolate machine for security investigation.

machine id setting =

isolation type setting = Selective