Automated Investigation and Response (AIR) recommendations are reviewed and actioned
Overview
Section titled “Overview”Microsoft Defender for Endpoint Automated Investigation and Response collects supporting evidence from an alert — process trees, file hashes, registry and persistence changes, network connections, signed-in users — and proposes endpoint remediation actions such as quarantining a malicious file, terminating a running process, removing a persistence entry, or isolating the device. When the device group is configured to require analyst approval and those actions sit in pendingApproval, the malicious binary keeps running, the attacker keeps issuing command-and-control traffic, and credentials continue to be harvested for the duration of the delay — the detection landed but the host was never actually contained. This check confirms there are no endpoint AIR actions left in pendingApproval past the response window, so a confirmed endpoint detection translates into removal from the host rather than a paused investigation.
Remediation
Section titled “Remediation”- Automated investigation and response in Microsoft Defender XDR
- Review remediation actions in the Action center
- Configure automated investigation and response in Microsoft Defender for Endpoint
- Set automation levels in Microsoft Defender for Endpoint
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Threat investigation and response |
| Product | Defender |
| Feature | Tenant settings |
| Area | Logging and detection |
| Licence | WINDEFATP |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.