4.3Device response in Defender for Endpoint

On a suspected device, trace what happened chronologically and, if needed, operate remotely to contain it. Defender for Endpoint provides these as an EDR.

4.3.1Device timeline and evidence investigation

The device timeline shows events on a device (processes, files, network, registry) chronologically, reconstructing the attack. Investigate an incident’s evidence and entities (files/processes/IPs/users) to judge maliciousness. Analysts identify scope from the timeline and decide whether remediation is needed.

4.3.2Device actions and attack disruption

For remote response, use live response (shell into the device to fetch files, stop processes, run scripts), collect an investigation package (bulk forensic data), isolate the device, block files, etc. If automatic attack disruption (Chapter 1) has already isolated/contained the device, analysts confirm the result, investigate root cause, and release isolation after verifying safety.