Isolating a machine upon new malware detection

In this example, we will use integration between Microsoft Sentinel and Microsoft 365 Defender to run a playbook and isolate a machine infected by ransomware.

Before we begin, you will need the following:

• You need to have access to Microsoft Sentinel with appropriate permissions (Microsoft Sentinel Contributor, Logic App Contributor, and permission to assign RBAC controls – Owner or User Access Administrator)
• Global Administrator or Security Administrator role permissions in Azure AD

Creating a playbook

We will need to do the following in this example:

1. Gain access to Microsoft Defender for Endpoint (MDE).
2. Connect MDE to Microsoft Sentinel for incident synchronization.
3. Create a test alert using MDE.
4. Create a playbook to isolate a machine in MDE and assign permissions.

Step 1 – gain access to MDE

The first step is to have access to MDE. If you already have MDE on your tenant...