Microsoft Defender for Endpoint - Malware Detected

This playbook investigates “Malware detected by Microsoft Defender for Endpoint” by gathering Hash and User information and performing remediation based on the information gathered and received from the enrichment. Used Sub-playbooks: * Enrichment for Verdict To link this playbook to the relevant alerts automatically, we recommend using the following filters when configuring the playbook triggers: Alert Source = Correlation AND Alert Name = Malware detected by Microsoft Defender for Endpoint

Microsoft Defender for Endpoint · 12 tasks · 0 inputs · 0 outputs

Commands used

closeInvestigation setAlert

Flowchart

Malicious File Start Start Enrich Indicators Enrich Indicators Enrichment for Verdict - Enrichment for Verdict Enrichment for Verdict Enrichment for Verdict Continue based on verdict Continue based on verdict True Positive True Positive Continue manual investigation Continue manual investiga... Done Done False Positive False Positive Lower alert severity - setAlert Lower alert severity setAlert Close the alert as False Positive - closeInvestigation Close the alert as False ... closeInvestigation Close the alert as True Positive - closeInvestigation Close the alert as True P... closeInvestigation Enter the Investigation details Enter the Investigation d...