Question

Your organization uses Microsoft Defender XDR. An incident triggered an automated investigation (AIR) on a compromised endpoint. When you open the investigation, the status shows 'Pending action' and several remediation actions are queued but not executed. You need the recommended remediation actions to run so the threat is contained, while following the principle of least manual intervention going forward. What should you do?

Accepted Answer

Approve the pending actions from the Action center, then set the device group's automation level to 'Full - remediate threats automatically'

Answer

Manually isolate the device with a response action and ignore the pending automated actions

Answer

Change the incident status to Resolved so the queued actions execute automatically

Answer

Create an advanced hunting custom detection rule to run the remediation