Isolating a machine upon new malware detection
In this example, we will use integration between Microsoft Sentinel and Microsoft 365 Defender to run a playbook and isolate a machine infected by ransomware.
Before we begin, you will need the following:
- You need to have access to Microsoft Sentinel with appropriate permissions (Microsoft Sentinel Contributor, Logic App Contributor, and permission to assign RBAC controls – Owner or User Access Administrator)
- Global Administrator or Security Administrator role permissions in Azure AD
Creating a playbook
We will need to do the following in this example:
- Gain access to Microsoft Defender for Endpoint (MDE).
- Connect MDE to Microsoft Sentinel for incident synchronization.
- Create a test alert using MDE.
- Create a playbook to isolate a machine in MDE and assign permissions.
Step 1 – gain access to MDE
The first step is to have access to MDE. If you already have MDE on your tenant...