MDE - Pro-Active Actions

This playbook is part of the 'Malware Investigation And Response' pack. For more information, refer to https://xsoar.pan.dev/docs/reference/packs/malware-investigation-and-response. This playbook supports investigation actions for the analyst, including: - Running a full AV scan for a specific endpoint - Requesting an investigation package (a zip file containing forensic data with a size of ~ 15MB) from an endpoint. - Requesting to run automatic investigation on an endpoint.

Microsoft Defender for Endpoint · 23 tasks · 5 inputs · 0 outputs

Inputs

  • Task — A comma-separated list of investigation actions. Possible values: `Full Scan` - Fully Scan the provided endpoints `Collect Investigation Package` - Collect investigation packages from endpoints (only for supported devices) `Automated Investigation` - Run automated investigation on the provided endpoints
  • EndpointsID — Provide a list of endpoints for the Scan and Collection of investigation Package to be run on.
  • AutoCollectinvestigationPackege — True/Fasle
  • AutoAVScan — True/Fasle
  • AutoAutomatedInvestigation — True/Fasle

Commands used

microsoft-atp-run-antivirus-scan microsoft-atp-start-investigation

Flowchart

true false true true false true Input Input Input Automated Investigation false true true Scan package Start Start AV Scan AV Scan Auto full AV Scan process? Auto full AV Scan process? Full Av Scan - microsoft-atp-run-antivirus-scan Full Av Scan microsoft-atp-run-antivirus-scan Approve AV Scan Approve AV Scan AV Scan done AV Scan done Collect investigation package Collect investigation pac... Auto collect investigation package from the Endpoint? Auto collect investigatio... Approve Investigation package collection Approve Investigation pac... Investigation Package Collection Done Investigation Package Col... Done Done Define Additional Actions Define Additional Actions Check Auto Tasks Check Auto Tasks Check Auto Tasks Check Auto Tasks Microsoft Defender For Endpoint - Collect investigation package - Microsoft Defender For Endpoint - Collect investigation package Microsoft Defender For En... Microsoft Defender For Endpoi... Automated Investigation Automated Investigation Approve Automated Investigation Approve Automated Investi... AV Scan done AV Scan done Auto-run automated investigation? Auto-run automated invest... Start Automated Investigation On Endpoint - microsoft-atp-start-investigation Start Automated Investiga... microsoft-atp-start-investiga... Check Auto Tasks Check Auto Tasks Check Auto Tasks Check Auto Tasks Done Done