Investigations Flashcards
What are the automated investigation and remediation (AIR) levels in Defender for Endpoint?
- Non protected
- Semi- require approval for any remediation
- Semi- require approval for non-temp folders
- Semi- require approval for Core folders
- Full – Remediate threats automatically
What functionalities does the Action Center offer in terms of managing investigations?
The Action center keeps track of all the investigations that were initiated automatically, along with details, such as investigation status, detection source, and any pending or completed actions
How does the Action Center handle additional alerts generated from a device while an investigation is ongoing?
While an investigation is running, any other alerts generated from the device are added to an ongoing automated investigation until that investigation is completed.
If the same malicious file was detcted on the any other devices during the investigation, how will the automated investigation handle that?
If the same threat is seen on other devices, those devices are added to the investigation
How are threats remediated by AIR?
Every triggred alert gets a vetrtict. Verdicts are then assigned to each piece of evidence investigated, categorized as Malicious, Suspicious, or No Threats Found. These verdicts may prompt one or multiple remediation actions, such as quarantining a file, stopping a service, or removing a scheduled task
What factors affect whether a Vertic is flagged as Malicious, Suspicious, or No threats found?
. Type of threat
. Resulting verdict
. How the organization’s device groups are
configured
Which action sources are possibly found in the action center?
.Manual device action
.Manual email action
.Automated device action
.Automated email action
.Advanced hunting action
.Explorer action
.Manual live response action
.Live response action
What are some examples of Automated device action?
An automated action taken on an entity, such as a file or process. Examples of automated actions include sending a file to quarantine, stopping a process, and removing a registry key.
