3.4. Respond to Alerts in Defender for Endpoint
💡 First Principle: The endpoint is where attackers actually run their code, so it holds the most precise evidence (exact processes, files, and connections) and offers the most precise containment (stop this process, quarantine this file, cut this device off). Endpoint response is a ladder: investigate with the least disruptive tools first, escalate containment as confidence and danger rise.
Why care: endpoint response actions are among the most concretely tested items on the exam: which action preserves forensic data, which still lets the user use Teams, which runs only Microsoft-signed code, and what an investigation package contains. Picking the wrong rung either destroys evidence or leaves the attacker active.
The response ladder, from least to most disruptive:
⚠️ Common Misconception: "Isolating a device also disconnects it from Defender for Endpoint." Isolation blocks other network traffic but keeps the device connected to the Defender service, so you can still investigate, run live response, and release it. Another misconception holds that live response can run any script by default; scripts must come from the library, and unsigned PowerShell scripts need an advanced setting.
