.png?sv=2019-07-07&sig=7rWOvcrQCwfMnOR7LVMhn73B5ryCBWd%2FNfia3L0zFl0%3D&spr=https%2Chttp&st=2023-03-25T10%3A39%3A56Z&se=2023-03-25T10%3A49%3A56Z&srt=o&ss=b&sp=r){kind=logo}
Microsoft Defender ATP - Isolate/Unisolate Assets
- 16 Mar 2023
- 1 Minute to read
-
Print
-
DarkLight
-
PDF
Microsoft Defender ATP - Isolate/Unisolate Assets
- Updated on 16 Mar 2023
- 1 Minute to read
-
Print
-
DarkLight
-
PDF
Microsoft Defender ATP - Isolate Assets quarantines each of the query results assets (endpoints) from the network that are the result of the saved query supplied as a trigger (or devices selected in the asset table).
Microsoft Defender ATP - Unisolate Assets restores full network connectivity to each of the query results entities (endpoints).
NOTE
To use the actions below, you must successfully configure a Microsoft Defender for Endpoint adapter connection.
See Creating Enforcement Sets to learn more about adding Enforcement Actions to Enforcement Sets.
General Settings
- Enforcement Set name (required) - The name of the Enforcement Set. A default value is added by Axonious. You can change the name according to your needs.
- Add description (optional) - Click to add a description of the Enforcement Set. It is recommended to describe what the Enforcement Set does.
- Run action on assets matching following query (required) - Select an asset category and a query. The Enforcement Action will be run on the assets that match the query parameters.
- A query only returns results for the asset type it was created for.
- Not all asset categories are supported for all Enforcement Actions.
- See Actions supported for Activity Logs and Adapter Fetch History Modules
- Action name - The name of the Main action. A default value is added by Axonious. You can change the name according to your needs.
- Configure Action Conditions - Toggle on to enter a condition statement. See Configuring Enforcement Action Conditions to learn more about condition statement syntax.
Isolate in Microsoft Defender ATP
Action Settings
- Comment - Enter a comment that will be displayed.
- Isolation Type - Select an isolation type, either 'Full' or 'Selective'.
Unisolate in Microsoft Defender ATP
Action Settings
- Comment - Enter a comment that will be displayed.
- Isolation Type - Select an isolation type, either 'Full' or 'Selective'.
Required Permissions
The Azure AD application configured in the Defender ATP adapter must have the following Application permission:
- Machine.Isolate
See Microsoft Defender ATP documentation for more information.
For more details about other Enforcement Actions available, see Action Library.