Automated Investigation and Response (AIR) recommendations are reviewed and actioned

Overview

Microsoft Defender for Office 365 Automated Investigation and Response investigates email-related alerts and proposes remediation actions such as soft-deleting a malicious message from recipients’ mailboxes, blocking a sender, URL, or file hash through the Tenant Allow/Block List, or moving suspicious mail to quarantine. When these recommended actions wait for analyst approval and the approval queue is not worked, the confirmed phishing or malware message remains in the recipient’s mailbox while the verdict already says it is malicious; the user opens the link or attachment in the intervening minutes or hours and the threat actor obtains the credential or executes the payload — the detection landed but containment never reached the inbox. This check confirms there are no Microsoft Defender for Office 365 incidents left stale beyond the response window, so an email-side detection translates into removal from mailboxes rather than a paused investigation.

Remediation

• Automated investigation and response (AIR) in Office 365
• Approve or reject pending actions in AIR
• Action center in Microsoft 365 Defender
• Investigate incidents in Microsoft 365 Defender

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	SecOps
Category	Email and collaboration security
Product	Defender
Feature	Tenant settings
Area	Logging and detection
ATT&CK	T1566 Phishing
Licence	THREAT_INTELLIGENCE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.