Configure Stop and Quarantine File capability in Microsoft Defender for Endpoint

  • 릴리스 버전: Australia
  • 업데이트 날짜 2026년 03월 12일
  • 소요 시간: 2분

    • Stop and quarantine files from the Microsoft Defender platform.

    시작하기 전에

    Supported Observable Types: SHA1 hash.

    표 1. Requirements for Stop and Quarantine File capability
    Input Description
    Comment (Required: Comment to associate with the action)

    Role required: sn_si.admin or sn_si.analyst

    이 태스크 정보

    You can run the Stop and Quarantine File action on the particular observables of type SHA1 only. Store the details on the Additional Actions on Endpoint table. You can trigger the Stop and Quarantine File capability from the Microsoft Defender for Endpoint Related Machines details related list.

    프로시저

    1. Navigate to Security Incidents > Show All Incidents.
    2. Select the security incident that you want to review with the Microsoft Defender for Endpoint information.
    3. In the related links section, click Show All Related Lists.
    4. Click the Microsoft Defender for Endpoint Related Machines Details related list.
    5. Select one or more records.
    6. From the Actions on selected rows, select the Stop and Quarantine File capability.
    7. Validate the automation activity and activities section.
    8. View the data, and validate the data on the related lists.
    9. View the automation activities of the execution, and validate them.