SC-200 Defender for Endpoint Response: Device Timelines, Live Response, Isolation and Attack Disruption

The device timeline is the chronological record of everything Microsoft Defender for Endpoint saw on one device, and it is where you reconstruct an attack on that device. You open it from the device page. By default it shows the past 30 days; you can pick a custom date range to narrow it.

• Data type filter. The timeline can show Events (process, file, network, registry and logon activity) or Techniques, which are entries mapped to MITRE ATT&CK techniques. Filtering to Techniques changes what is displayed; it doesn't pick out specific events you chose.
• Event flags. Select the flag icon on any event to mark it for follow-up. Turning on Flagged events under Filters then shows only flagged events, which you can sort, filter and export. This is how you build a clean attack chain for a report.
• Event details. Selecting an event opens a side pane with the process tree, file and network details and any related alert.
• Hunt for related events. From the side pane, this opens advanced hunting with a ready-made query that returns the selected event plus the events recorded around the same time on the same device. Started from a technique entry, the query returns all events related to the technique but not the technique entry itself.
• Export. The detailed export covers the current date or a date range of up to seven days. The display window and the export window are separate limits: the timeline can show 30 days, while each export covers seven days at most.

Go hunt, by contrast, is an entity pivot (for example from the incident graph) that queries an entity's activity across tables; it isn't built around one timeline event.

Device response actions are the buttons on a device page, such as isolate, contain, restrict apps, scan, collect a package and live response, and most of them need Defender for Endpoint Plan 2. Plan 1 includes only four manual response actions; everything else on the device page is Plan 2.

Taking these actions needs the Active remediation actions permission (or a role that includes it, such as Security Administrator). Every action you submit is recorded in the Action center, which shows who submitted it, when, and whether it succeeded, and it also adds an event to the device timeline. Live response configuration and device-group automation levels belong to configuring Defender for Endpoint, not to this topic.

Isolate a device you manage to cut it off the network, contain a device you can't isolate so other devices block it, and restrict app execution when the device must stay online but run only Microsoft-signed code. The three are easy to confuse because all of them limit an attacker; they differ in where they are enforced and what they block.

Isolate device

• Because the device keeps its link to the service, you keep receiving telemetry and can still run other actions on it, such as collecting a package.
• Selective isolation (Windows 10 version 1709 and later): when isolating, you can allow Outlook and Microsoft Teams connectivity so the user can keep communicating. You make this choice when you submit the isolation.
• Where web proxies are set by PAC, WPAD or static settings, a fully isolated device might not recover; Microsoft recommends selective isolation there. A device behind a full-tunnel VPN can't reach the Defender for Endpoint cloud once isolated; split-tunnel the Defender for Endpoint and Defender Antivirus cloud traffic.
• If the device is offline when you submit isolation, Defender for Endpoint retries for up to three days. After that window the action expires; submit it again once the device is back online.
• Isolating a Hyper-V host also cuts off its child virtual machines.
• For a device that stays unresponsive after isolation, Microsoft offers a force-release script you download from the portal, valid for three days. It is a recovery tool, not a way to prevent the problem.

Contain device

• Onboarded devices block both incoming and outgoing traffic with the contained device.
• If the contained device gets a new IP address, onboarded devices recognise it and block the new address; the old address is no longer blocked. New containments and IP changes can take up to five minutes to reach onboarded devices. A static IP indicator, by contrast, would miss an address change.
• Microsoft recommends containing up to 100 devices at a time, because large numbers can affect performance on onboarded devices. It also warns against containing devices that share an IP address with others (such as behind NAT) or network devices, which would cut off legitimate traffic.

Restrict app execution

The code integrity policy allows a file to run only if it is signed by a Microsoft-issued certificate, so line-of-business apps signed with your own company certificate are blocked too. Requirements:

• Microsoft Defender Antivirus on the device.
• Windows 10 version 1709 or later, Windows 11, or Windows Server 2019 or later.
• The policy must meet the Windows Defender Application Control (WDAC) code integrity policy formats and signing requirements.

Network connectivity is unaffected. While the restriction is in place, the device page button reads Remove app restrictions; an analyst selects it, adds a comment and confirms to lift the policy.

Run antivirus scan starts a quick or full Microsoft Defender Antivirus scan from the device page, and Collect investigation package gathers a zipped forensic snapshot of the device, both without typing commands on it.

Run antivirus scan

• Choose quick or full. The action works when Defender Antivirus is in passive mode alongside a third-party antivirus product, so there's no need to switch it to active mode (which would make Defender the primary product).
• The scan honours the Defender Antivirus ScanAvgCPULoadFactor setting. When it isn't configured, the default is 50% maximum CPU load; set it lower before running the action if a workload needs a tighter cap.
• Three traces: the Action center shows the scan action's details and status, the device timeline gets an event that a scan was submitted, and threats found are reported as Microsoft Defender Antivirus alerts.

Collect investigation package

On Windows the package is a zip file containing, among other things:

When collection finishes, download the package from the Action center. Collection can fail if the device has a low battery or is on a metered connection; fix those conditions and resubmit. Because an isolated device keeps its connection to the Defender for Endpoint service, you can collect a package from it while it stays isolated.

Live response is a remote shell on an onboarded device, opened from the device page, that lets an analyst run investigation and remediation commands, collect files and run scripts in real time. Commands are split by permission: basic live response allows read-only investigation, and advanced live response adds commands that change the device.

Before a session can start

• Live response must be turned on in Settings > Endpoints > Advanced features, by an admin or a user with the Manage Portal Settings permission. Live response for servers is a separate setting on the same page.
• Unsigned script execution is a third, optional setting. Signature verification applies only to PowerShell scripts, so an unsigned PowerShell script runs only when this setting is on.
• Uploading a file to the library from the session console needs the Manage Security Settings permission. The Library management page offers another upload route that doesn't need it.

Commands

On Windows, the antivirus scan, investigation package and isolation are taken from the device page as response actions rather than as live response commands.

• Scripts run from the library. Live response runs PowerShell and Bash scripts, but each script must first be uploaded to the tenant-level live response library; then run executes it on the device. putfile also copies files from the library, and the files it places in the working folder are deleted when the device restarts by default.
• Background downloads. Append & to getfile to run the download in the background (or press Ctrl+Z on a running download), keep working, and use fg with the command ID shown by jobs to bring it back to the foreground.
• Prerequisites and output. Some commands, such as remediate, have a prerequisite command; adding -auto runs it automatically. -output json or -output table changes the output format, and > redirects a command's output to a file.
• Ctrl+C cancels only in the portal. It doesn't stop the command on the device, so a changing operation such as remediate may still complete after you cancel it. Verify the entity's state afterwards; undo restores a remediated entity on Windows and Windows Server.

getfile "D:\Logs\export-0427.evtx" &
jobs
fg 2210
processes > proc-list.txt
remediate service "UpdSvcHelper" -auto
undo service "UpdSvcHelper"

Live response limits

Live response is limited per device, per user and per tenant, by idle and command time, and by file size.

Each limit applies independently: the device limit counts sessions on that device from any analyst, and the user limit counts one analyst's sessions across all devices. A getfile transfer also has to finish within its 30-minute command limit, so on a slow link Microsoft suggests splitting a large file into smaller parts and downloading them separately.

The file page shows where a file has been seen and lets you act on it across the organization: stop and quarantine it, block it, send it to deep analysis, or download or collect it.

File page investigation

• The prevalence card counts devices in the organization that saw the file within your RBAC scope, so analysts scoped to different device groups see different numbers. Prevalence outside the organization is shown separately.
• The Observed in organization tab lists devices that had the file, with device history going back up to six months (30 days for the trend line and cloud apps). Selecting a device shows its file history and pivots to the first-seen event in the device timeline. It also lists the file names seen.

File response actions

Stop and quarantine has a three-day timeout. If a targeted device stays offline longer than that after you submit the action, the action isn't delivered to it. Microsoft recommends adding a block indicator for the file so it stays blocked beyond the timeout and after the action completes, including on devices where it turns up later. A file quarantined in error can be restored on the device with MpCmdRun -Restore.

Permissions depend on file type. Alerts investigation allows file actions on portable executables (.exe, .dll, .sys) only. Live response advanced allows them on PE and non-PE files (.docx, .txt). Live response basic and View data allow neither. Security Administrator also covers both, but it grants far more than file collection.

Deep analysis

• Deep analysis runs the file in a secure, fully instrumented cloud environment and reports behaviors and observables; matches against threat intelligence raise alerts. It takes several minutes.
• It supports portable executables only, such as .exe and .dll files, and not Windows App Store executables. Scripts and documents can't be submitted.
• Submit is enabled when the sample is already in the Defender for Endpoint backend, or the file was observed on a Windows 10, Windows 11 or Windows Server 2012 R2+ device that can supply it. Otherwise you can submit the file through the Microsoft Security Intelligence submission portal and wait for the button to become available.
• Sample collection has a three-hour timeout. If no supported device holding the file is online and reporting in that time, collection fails and the submission aborts; resubmit later.
• Sample collection is allowed by default. When a policy configures it, the registry value AllowSampleCollection under HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection decides: 0 blocks collection and 1 allows it. A block applies to every file from that device.

Entity pages for IP addresses, and the incident's Evidence and Response tab, tell you which devices and entities an attack touched and what Defender decided about each.

• The IP address page shows geolocation details, related alerts, the devices in the organization observed communicating with the IP, and its prevalence with first and last seen dates. The prevalence period defaults to 30 days.
• The observed-devices list is limited to 100 devices. For a complete list of the devices that communicated with the address, query advanced hunting:

DeviceNetworkEvents
| where RemoteIP == "198.51.100.23"
| summarize LastSeen = max(Timestamp) by DeviceName

• Advanced hunting searches the network events of every device in the organization, so its result isn't capped and can be extended with more columns or time filters.
• On an incident, the Evidence and Response tab lists the entities in the incident's alerts (files, processes, devices, users, IPs, mailboxes) with a verdict (such as malicious, suspicious or no threats found) and remediation status. Remediation actions that need approval wait in the Action center under Pending until an analyst approves or rejects them.

Automatic attack disruption is the Defender XDR capability that contains compromised assets on its own during high-confidence attacks such as human-operated ransomware or business email compromise, and an incident it acted on is reviewed from the incident page. A disrupted incident carries the Attack Disruption tag and the threat type, shows a banner, and labels each contained or suspended asset.

• The attack disruption summary card on the incident page summarises the automatic actions taken. View activities opens the Activities tab with every automated action; View related assets lists the endpoints, accounts, mailboxes and apps acted on. The Investigations tab (automated investigations), Evidence and Response tab (entities and verdicts) and blast radius view (possible propagation paths) answer other questions.
• In the Activities tab, filter Performed by to AttackDisruption (this also includes predictive shielding actions), Activity status to Completed to drop partial or in-progress actions, and Policy status to everything except Not applicable to leave out reversal actions.

Policy status is where you see whether a disruption policy is enforced right now. Configuring attack disruption and its exclusions is part of configuring XDR (Domain 1); finding disrupted email and identity incidents is covered with the other Defender workloads.

Contain user is an endpoint-enforced block on a compromised identity, and automatic device isolation cuts compromised workstations off the network; both are applied automatically, and neither has a manual button.

Contain user

• Triggers. Contain user is applied by automatic attack disruption, or by predictive shielding (preview), which applies it more selectively to users predicted to be high risk and prevents new sessions rather than terminating existing ones. The action itself is generally available under both triggers.
• Effect. Supported onboarded devices block the contained identity's incoming traffic in attack-related protocols: network logons, RPC, SMB and RDP. Under attack disruption they also end its ongoing remote sessions and log off existing RDP connections with their processes. Other traffic continues to flow normally.
• Account state. Contain user works at the endpoint layer and leaves the account enabled in Microsoft Entra ID and Active Directory, so it doesn't govern cloud sign-ins from a computer that isn't onboarded. Disabling the account in Microsoft Entra ID is the control that stops sign-ins everywhere.
• Domain controllers. When Contain user is enforced on a domain controller, it starts a GPO update on the Default Domain Controller policy, which syncs across domain controllers. Undoing it reverts the GPO and triggers another sync, so GPO-change monitoring will report both.
• Ending it. A user contained by attack disruption is removed from containment automatically within five days. To end it sooner, select the Contain User action in the Action center and choose Undo, or select the user in the user inventory, incident side pane or alert side pane and choose Undo. Undoing Contain user requires the Global Administrator role in Microsoft Entra ID.
• Its effects are visible in the device timeline and in advanced hunting (next section).

Automatic device isolation

• Applies only to end-user workstations onboarded to and managed by Defender for Endpoint, not servers. For critical assets such as domain controllers and DNS or DHCP servers, disruption contains rather than isolates.
• Two kinds of exclusion behave differently. A selective isolation exclusion rule decides what stays reachable while a device is isolated: when one exists, disruption isolates selectively and honours the rule. An attack disruption exclusion (a device tag plus a policy application that excludes the Isolate device action) stops isolation altogether, and the action shows as Skipped in the Action center.
• Automatic isolation is applied as part of the disruption without waiting for approval; analysts review it afterwards and can release it early.

Once the investigation is complete, you release each disrupted asset with the action that matches how it was contained, and you hunt the results with three advanced hunting tables.

A device that an attack disruption exclusion protected was never isolated, so its Skipped action needs no release.

Hunting disruption results

• DeviceEvents logs the block actions that result from containment: each connection or logon attempt a contained user or device was denied. Action types containing ContainedUser are attempts blocked because a user was contained; ContainedDevice because a device was contained.
• DisruptionAndResponseEvents gives an organization-wide row per automatic action (contain device, contain user, disable account), the same actions shown in incidents' Activities tabs, with columns such as ActionType, AttackDisruptionCategory, DeviceName and AccountUpn.
• IdentityDirectoryEvents shows account disables in Active Directory.

DeviceEvents
| where ActionType contains "ContainedUser"

DisruptionAndResponseEvents
| where Timestamp > ago(30d)