Use “Release a Microsoft Defender endpoint machine from isolation” in Recued. It runs the Microsoft Defender for Endpoint release-from-isolation workflow for one machine with approval before changes are made.

How it works 10 steps

Inspect the data fetches, transforms, gates, and output this recipe runs.

Process (10 steps)

■ machine_id trim

Trim whitespace from setting machine id

■ comment trim

Trim whitespace from setting comment

■ machine_action_filter template

Generate text from a template

◆ machine_before recued-core.microsoft-defender-endpoint.machine.read

Read machine on microsoft defender endpoint

◆ actions_raw recued-core.microsoft-defender-endpoint.machine_action.search

Search machine action on microsoft defender endpoint

◆ release recued-core.microsoft-defender-endpoint.machine.unisolate

Unisolate machine on microsoft defender endpoint

■ actions default

Apply default

■ action_count count

Count items in actions

■ card to_summary

Format results as a summary card

■ actions_table to_table

Format results as a data table

▼

Output

summary card

table actions_table

Settings 2 configurable

Configurable at install. Defaults shown — change them anytime in Recued.

comment setting = Release machine from isolation after validation.

machine id setting =