Investigated, then shut down.
Everything in Managed Investigation, and when the verdict is real, the agent contains it. Isolate the host, disable the account, block the indicator.
Malicious DNS query from FIN-WKS-04
Allow well-understood actions to run the moment the verdict lands.
Encoded PowerShell on FIN-WKS-04
Everything else waits for a person.
Only the ones you grant.
Isolate a device
Network-isolate a compromised machine in Microsoft Defender for Endpoint, full or selective, your call per incident.
Release a device
Lift the isolation the same way once it’s clean, so the machine is back on the network without anyone touching the console.
Disable an account
Kill a takeover fast: disable the account so the session an attacker is riding stops working.
Reset a password
Force a credential reset and issue a Temporary Access Pass, so the real owner can get back in and the attacker can’t.
Run an antivirus scan
Trigger an AV/EDR scan on a host to confirm what’s on it before you decide how far to go.
Block an indicator
Push an IP, domain, hash or URL to your block list before it spreads to the next machine.
Every action is cryptographically signed, forever.
Who proposed it, who approved it, when it ran, and what it did: three entries in the same hash-chained, append-only ledger the investigation writes to. When someone asks “why was that machine isolated?”, the answer is a verifiable line, not a memory.
See a containment run, gated.
Twenty minutes. We walk a true positive through the agent, into the approval queue, and out to a sample playbook, and show you the signed entries it leaves behind.