Use “Update a Microsoft Defender endpoint alert” in Recued. It runs the Microsoft Defender for Endpoint alert workflow for one alert with approval before changes are made.

How it works 5 steps

Inspect the data fetches, transforms, gates, and output this recipe runs.

Process (5 steps)

■ alert_id trim

Trim whitespace from setting alert id

■ comment trim

Trim whitespace from setting comment

◆ alert_before recued-core.microsoft-defender-endpoint.alert.read

Read alert on microsoft defender endpoint

◆ alert_update recued-core.microsoft-defender-endpoint.alert.update

Update alert on microsoft defender endpoint

■ card to_summary

Format results as a summary card

▼

Output

summary card

Settings 6 configurable

Configurable at install. Defaults shown — change them anytime in Recued.

status setting = InProgress

comment setting = Update alert triage state from Recued.

alert id setting =

assigned to setting =

determination setting =

classification setting =