Automate response with Defender ATP and Microsoft Flow
So now when we have cool products (more or less builtin) we need to start working with them and not be required to look in the portals 24/7.
This post will demonstrate an example on how to use approval in email to isolate machines with new alerts.
Microsoft Flow is very easy to use to create business flows for all kind of products. You can manage anything which has an API.
Microsoft has released connectors for many solutions and by drag n drop you can create flows to make your life a lot easier.
This flow used in this blog post is just to be able to show something useful.
- Start by browsing to https://flow.microsoft.com and create a new flow
- Search for WDATP and select the Trigger “Triggers when a Windows Defender ATP alert accurs (preview)”
We will then add an action to “Get single alert preview”, this will give us more information to use later.
In below picture we can see some of the dynamic content we can add to next step in the flow
We can also add a condition. In this example we use condition for alert severity (high or medium).
We also want to add an approver step.
For some reason the Approval type is in Swedish for me. You have 2 default options and one custom option
Options are “Everyone must approve” or “First one to approve”.
Based on the response from the approval step we continue the flow with a condition to go ahead if the responder choose to approve the action.
We add the action “Isolate machine (preview)” and configure that along with a send email action.
Running the Flow
If you need to change your flow you can re-run it using the same data as used previously
After the approval we get the status message send to all approvers
We can see that our test machine was successfully isolated
In the flow test overview
From the ATP console we now have the option to release the machine from isolation, collect investigation package etc
Dynamic content
Actions
Pro tips:
- Use get alert to be able to add more dynamic content to use in subsequent steps
- Use get machine to be able to get more information like IP, Computername etc
- Start building your automated playbooks. This will save you time