# Automated Investigation and Response (AIR) recommendations are reviewed and actioned
Microsoft Defender for Endpoint Automated Investigation and Response collects supporting evidence from an alert — process trees, file hashes, registry and…
Source: https://maester.dev/docs/tests/ZTA.41062
## Overview
Microsoft Defender for Endpoint Automated Investigation and Response collects supporting evidence from an alert — process trees, file hashes, registry and persistence changes, network connections, signed-in users — and proposes endpoint remediation actions such as quarantining a malicious file, terminating a running process, removing a persistence entry, or isolating the device. When the device group is configured to require analyst approval and those actions sit in `pendingApproval`, the malicious binary keeps running, the attacker keeps issuing command-and-control traffic, and credentials continue to be harvested for the duration of the delay — the detection landed but the host was never actually contained. This check confirms there are no endpoint AIR actions left in `pendingApproval` past the response window, so a confirmed endpoint detection translates into removal from the host rather than a paused investigation.
## Remediation
- [Automated investigation and response in Microsoft Defender XDR](https://learn.microsoft.com/en-us/defender-xdr/m365d-autoir)
- [Review remediation actions in the Action center](https://learn.microsoft.com/en-us/defender-xdr/m365d-autoir-actions)
- [Configure automated investigation and response in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/configure-automated-investigations-remediation)
- [Set automation levels in Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/defender-endpoint/automation-levels)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Threat investigation and response |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Tenant settings |
| Area | Logging and detection |
| Licence | WINDEFATP |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.