2.4.2. Automated Investigation and Response
💡 First Principle: Most alerts follow a few predictable investigation paths: check the file, check the process tree, check related devices and mailboxes, then remediate. Automated investigation and response (AIR) runs those paths as a machine would, around the clock, examining each piece of evidence, issuing a verdict, and remediating within limits you set. It acts as a virtual Tier 1 analyst, which is why Microsoft also calls it self-healing.
When an alert creates an incident, AIR can start an automated investigation. As it runs, related alerts join it, and if an affected entity shows up elsewhere, the investigation expands to include it. Every piece of evidence receives a verdict: Malicious, Suspicious, or No threats found. For malicious and suspicious evidence, AIR identifies remediation actions such as quarantining a file, stopping a process, removing a scheduled task or registry key, isolating a device, blocking a URL, or soft-deleting malicious email.
Whether remediation happens automatically depends on configuration. For devices, the device group's automation level decides (2.3.3): Full remediates on its own; the Semi levels hold actions for approval. For email, Defender for Office 365 Plan 2 automated investigations produce actions that typically await approval. AIR correlates evidence across Defender for Endpoint (devices), Defender for Identity (on-premises identities), and Defender for Office 365 (email).
The Action center is the single place for all of it. The Pending tab lists actions awaiting approval, where an analyst approves or rejects them; the History tab records every completed action, manual or automatic, and is where many actions can be undone (for example, restoring a quarantined file or releasing a device from isolation). The Investigations tab on an incident shows each automated investigation's graph, evidence, and results.
⚠️ Exam Trap: "AIR identified malicious files but didn't remove them" points at the device group automation level (a Semi level or No automated response) leaving actions pending in the Action center. The fix is approving the pending actions or raising the automation level, not rerunning the investigation.
Reflection Question: Why is Full automation Microsoft's recommended level for most devices, and what kind of device would justify Semi - require approval for all folders despite the slower response?
