Automated Investigation, Attack Disruption and Device Groups

What it is

Analysts cannot investigate every alert by hand. Automated investigation and response (AIR) examines alerts for you, decides what is malicious and proposes or takes remediation. Automatic attack disruption goes further and stops an attack in progress by containing the assets an attacker is using. Device groups decide who can see and act on which devices, and how much automation each group gets.

How it works

Automated investigation and response

When an alert is raised on a device, Defender for Endpoint can start an automated investigation. It collects evidence such as files, processes, services and scheduled tasks, analyses it, and gives each piece a verdict: malicious, suspicious, clean or no threats found. For malicious items it creates remediation actions.

Remediation actions an investigation can propose on a device include:

• Quarantine a file.
• Stop a process or a malicious service.
• Remove a scheduled task or a persistence entry.
• Remove a registry key.
• Isolate the device.

Actions that the investigation proposes are shown in the Action center, with two tabs: Pending for actions waiting for approval, and History for the actions that were taken, approved or rejected. Analysts can approve or reject, undo some actions, and see the evidence behind each decision. Actions that need a different product are not proposed by AIR, for example resetting a user's password or deleting a phishing email belong to identity and email protections.

Automation levels

How much AIR does by itself is set for each device group by its automation level.

Full automation is the default recommendation for most devices, because it speeds up response. A group of critical servers might use a semi level so a human checks the actions first.

Device groups

A device group collects devices so you can apply different settings to them. Groups are created in the Defender portal, and they are evaluated in rank order: a device joins the first group whose rule it matches. Devices that match no group fall into the default ungrouped devices group.

Membership rules can use:

• The device name, with matching conditions such as starts with or contains.
• The domain.
• Tags that you or a policy apply to devices.
• The operating system.

Device groups do three jobs.

For example, a regional SOC can be allowed to manage only the devices of its own region by assigning its role to that region's device group.

Permissions

Access to Defender for Endpoint is controlled with roles. Unified role based access control in the Defender portal lets you create roles with permissions such as view data, take response actions, manage security settings, and use live response, and assign them to users and groups over particular device groups. Give analysts the narrowest role, and reserve settings permissions for administrators.

Automatic attack disruption

Automatic attack disruption uses signals across email, identities, endpoints and cloud apps to recognise an attack in progress, such as ransomware or business email compromise, with high confidence. It then contains the compromised assets that the attacker is using, for example by isolating a compromised device or disabling a compromised account, to limit lateral movement and reduce the impact.

Important points:

• It acts automatically and quickly, while the attack is still unfolding.
• It leaves the security team in control. Analysts investigate, remediate and bring the assets back online.
• A contained device or user is shown on the incident, and analysts can release the containment when the threat is cleaned up.
• You can exclude specific assets from automatic disruption if a business reason requires it, but exclusions weaken protection and should be rare.

Attack disruption is a feature of Microsoft Defender XDR across several products. It needs the products that supply the signals, such as Defender for Endpoint, Defender for Office 365 and Defender for Identity, to be deployed.

Choosing the setting

A worked scenario

A company has 20,000 workstations and 300 production servers. Workstations are placed in a group with Full automation, so malware is quarantined as soon as it is found. The servers are in a separate group with a semi level, so every proposed action waits in the Action center for the server team. Regional analysts get a role that applies only to their region's device group. During a ransomware attempt, automatic attack disruption recognises the activity across devices and a compromised account, isolates the affected device and disables the account, and the analyst then investigates and releases the device.