Respond to Security Incidents · Topic 4 of 5
Responding in Defender for Endpoint
SC-200 endpoint response: device timeline, isolate, live response commands, investigation packages, deep analysis, evidence, entities and indicators.
- 6 min
- The device timeline shows events before and after an alert. The Evidence and response tab lists the entities.
- Isolate device cuts network access. Selective isolation keeps Outlook, Teams and Skype.
- Submit for deep analysis detonates a file in a sandbox and returns a behaviour report.
What it is
When an alert involves a device, Microsoft Defender for Endpoint gives you the tools to see exactly what happened and to act. You read the device timeline, inspect the evidence and the entities involved, use response actions to contain and clean the device, and open live response for hands on investigation.
How it works
The device timeline
The device page shows an alert history and a timeline of events on that device: process creations, network connections, file changes, logons, registry changes and security events, in time order. Use it to:
- Find what happened before and after an alert.
- Follow a process tree, to see which process started which.
- Filter by event type, search for a file name or command line, and mark events of interest.
- Export the timeline for the incident record.
Evidence and entities
The Evidence and response tab of an incident lists the files, processes, services, registry entries, emails, IP addresses and users that were involved, each with a verdict. Selecting an entity opens its entity page:
| Entity page | What it shows |
|---|---|
| File | Prevalence, signer, detections, which devices have it, and the option to submit it for deep analysis or block it |
| IP address and URL | Which devices connected, the reputation and related alerts |
| User | Sign ins, alerts and the devices used |
| Device | Alerts, timeline, logged on users and software |
From these pages you can look at how many devices a file has run on, which helps judge the scope.
Response actions on a device
| Action | What it does |
|---|---|
| Isolate device | Cuts the device off from the network, leaving a connection to Defender. A selective option keeps Outlook, Teams and Skype working |
| Restrict app execution | Only Microsoft signed applications may run |
| Run antivirus scan | Starts a scan on the device |
| Collect investigation package | Gathers forensic data from the device, such as processes, connections, autoruns and event logs, as a zip file |
| Initiate automated investigation | Starts AIR on the device |
| Live response | Opens a remote shell session |
| Stop and quarantine a file | Stops the process and moves the file to quarantine on every device where it is seen |
| Add an indicator | Allow, block, or alert on a file hash, IP address, URL or certificate |
If a file has never been seen and the analyst wants it detonated in a sandbox with a report of its behaviour, use Submit for deep analysis from the file page. A normal antivirus scan, an investigation package or an audit indicator do not give a behavioural report.
To find every laptop where a malicious file ran and isolate them, use the file entity page, which lists the devices and lets you act on them, or run an advanced hunting query on the file hash.
Live response
Live response gives analysts a command line session on a device, so they can investigate and fix without physical access. It must be enabled, and for servers the separate server setting must be on, and the analyst needs the right permission. Commands include:
| Command | Use |
|---|---|
connections | Lists active network connections |
processes | Lists running processes |
services | Lists services |
persistence | Lists persistence methods such as run keys and scheduled tasks |
getfile | Downloads a file from the device to the analyst |
putfile or library | Uploads a file or runs a script from the library |
run | Runs a script from the library |
remediate | Remediates a file or other entity |
analyze | Analyses an entity such as a file for a verdict |
Live response sessions are logged. Running unsigned scripts needs a separate advanced feature setting. Use live response for targeted work, such as collecting a suspicious file or killing a process, and use it with care because it acts on a live machine.
Incidents identified by automatic attack disruption
When automatic attack disruption contains a device or account, the incident shows the contained assets. Investigate the incident, clean the device, and then release the device from containment so it can reconnect. Do not release before the threat is removed.
Choosing the action
| The situation | Action |
|---|---|
| A device is actively beaconing to an attacker | Isolate the device |
| An analyst needs to see running connections on a laptop | Live response, connections |
| A suspicious unknown executable must be analysed | Submit for deep analysis |
| Forensic data is needed for an outside team | Collect investigation package |
| A hash is confirmed malicious across the company | Add a block indicator |
| A contained server is clean again | Release from isolation |
A worked scenario
An alert shows a script running from a user's temp folder on a laptop. The analyst opens the device timeline and follows the process tree from an Office document to PowerShell to a network connection. She isolates the device with the selective option so the user can still reach Teams, then opens live response to run connections and persistence, and finds a scheduled task. She downloads the malicious file with getfile, submits it for deep analysis, adds a block indicator for its hash, and removes the task. The file entity page shows it also ran on two servers, which she isolates. After remediation, she releases all three devices.
What to remember for the exam
- The device timeline shows events before and after an alert. The Evidence and response tab lists the entities.
- Isolate device cuts network access. Selective isolation keeps Outlook, Teams and Skype.
- Submit for deep analysis detonates a file in a sandbox and returns a behaviour report.
- Live response commands include connections, processes, services, persistence, getfile and run. It needs enabling, and servers have a separate setting.
- Indicators allow, block or alert on hashes, IPs, URLs and certificates.
Use connections for network connections, processes for running processes, services for services and persistence for persistence methods.
How the exam asks about this
- "Which live response command lists active network connections?" connections.
- "Detonate a never seen executable and get a behaviour report." Submit for deep analysis.
- "Cut a device off but keep it reporting to Defender." Isolate device.
- "Find every device where a malicious file ran." The file entity page, or an advanced hunting query on its hash.
Common mistakes
Running a normal scan to analyse unknown malware. It gives no behavioural report.
Forgetting to release isolation. Devices stay offline.
Enabling live response but not for servers. Sessions to servers fail.
Blocking a hash without checking prevalence. You may block legitimate software.
Check yourself
What does the Submit for deep analysis action do?
It detonates the file in a sandbox and returns a report of its behaviour.
Which live response command lists persistence methods?
persistence.
What is the difference between isolating and restricting app execution?
Isolation cuts network access, and restricting app execution allows only Microsoft signed apps to run.
Topic 4 of 5 in Respond to Security Incidents
Test yourself on Respond to Security Incidents
The full Microsoft SC-200 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.