Use “Update a Microsoft Defender endpoint alert” in Recued. It runs the Microsoft Defender for Endpoint alert workflow for one alert with approval before changes are made.

How it works 5 steps

Inspect the data fetches, transforms, gates, and output this recipe runs.

Process (5 steps)

■ alert_id trim

Trim whitespace from setting alert id

■ comment trim

Trim whitespace from setting comment

■ alert_before ?

■ alert_update ?

■ card to_summary

Format results as a summary card

Settings 7 configurable

Configurable at install. Defaults shown — change them anytime in Recued.

status setting = InProgress

comment setting = Update alert triage state from Recued.

alert id setting =

assigned to setting =

determination setting =

classification setting =

microsoft defender setting =