Question

Your SOC uses an advanced hunting KQL query in Microsoft Defender XDR that reliably identifies devices where a malicious scheduled task has been created for persistence. You want to operationalize this query so it runs automatically every hour, generates alerts, and immediately isolates the affected device without analyst intervention. What should you do?

Accepted Answer

Create a custom detection rule from the advanced hunting query, set the frequency, map impacted entities, and configure the 'Isolate device' response action.

Answer

Create a Microsoft Sentinel scheduled analytics rule from the query and attach a playbook that calls the Defender for Endpoint API to isolate the device.

Answer

Save the query as a shared query in advanced hunting and enable the built-in automatic attack disruption feature to isolate devices.

Answer

Configure an attack surface reduction (ASR) rule in block mode targeting scheduled task creation on the device group.