Question

A SOC analyst in Microsoft Defender XDR opens an incident that includes a Defender for Endpoint device isolation action and a Defender for Office 365 email remediation, both showing as 'Pending' in the incident's investigation. The organization has set automation level to 'Semi - require approval for all folders' for the affected device group. The analyst needs the fastest, correct way to execute the remediation actions that automated investigation has already recommended, while keeping a complete audit record. What should the analyst do?

Accepted Answer

Approve the pending actions from the Action center's Pending tab, which applies the automated investigation's recommended remediations and records the approver and timestamp.

Answer

Manually re-run each remediation using Live response and Threat Explorer, ignoring the pending actions since automated investigation results cannot be trusted at semi-automation level.

Answer

Change the device group automation level to 'Full - remediate threats automatically' so the pending actions execute retroactively without approval.

Answer

Dismiss the pending actions and open a new manual investigation, because pending actions expire before they can be approved in a multi-service incident.