During an incident, a SOC analyst uses live response on a Windows device in Microsoft Defender for Endpoint and runs the 'remediate' command to quarantine a suspicious executable. Follow-up analysis by the threat intelligence team confirms the file is a legitimate, custom-built line-of-business tool that was misclassified. The business owner needs the file restored on that specific device immediately, and the analyst wants the fastest supported method that also documents the reversal. What should the analyst do?