Responders (12)
MSDefender-PushIOC-Audit v1.0
Push IOC to Defender client. Audit mode
- Author: Vito Piserchia
- License: AGPL-V3
- Data Types:
thehive:case_artifact
MSDefender-PushIOC-Block v2.1
Push IOC to Defender client. Block mode
- Author: Keijo Korte, Louis-Maximilien Dupouy, Vito Piserchia
- License: AGPL-V3
- Data Types:
thehive:case_artifact
MSDefender-IsolateMachine v1.0
Isolate machine with Microsoft Defender for Endpoints
- Author: Keijo Korte
- License: AGPL-V3
- Data Types:
thehive:case_artifact
MSDefender-PushIOC-Warn v1.0
Push IOC to Defender client. Warn mode (Microsoft Defender for Cloud only)
- Author: Vito Piserchia
- License: AGPL-V3
- Data Types:
thehive:case_artifact
MSDefender-AutoInvestigation v1.0
Start an automated investigation on a device
- Author: Keijo Korte, Louis-Maximilien Dupouy
- License: AGPL-V3
- Data Types:
thehive:case_artifact
MSDefender-FullVirusscan v1.0
Run full virus scan to machine with Microsoft Defender for Endpoints
- Author: Keijo Korte
- License: AGPL-V3
- Data Types:
thehive:case_artifact
MSDefender-RestrictAppExecution v1.0
Restrict execution of all applications on the device except a predefined set
- Author: Keijo Korte, Louis-Maximilien Dupouy
- License: AGPL-V3
- Data Types:
thehive:case_artifact
MSDefender-UnisolateMachine v1.0
Unisolate machine with Microsoft Defender for Endpoints
- Author: Keijo Korte
- License: AGPL-V3
- Data Types:
thehive:case_artifact
MSDefender-PushIOC-BlockAndRemediate v1.0
Push IOC to Defender client. Block and Remediate mode
- Author: Vito Piserchia
- License: AGPL-V3
- Data Types:
thehive:case_artifact
MSDefender-PushIOC-Allowed v1.0
Push IOC to Defender client. Allowed mode
- Author: Vito Piserchia
- License: AGPL-V3
- Data Types:
thehive:case_artifact
MSDefender-UnRestrictAppExecution v1.0
Enable execution of any application on the device
- Author: Keijo Korte, Louis-Maximilien Dupouy
- License: AGPL-V3
- Data Types:
thehive:case_artifact
MSDefender-PushIOC-Alert v2.0
Push IOC to Defender client. Alert mode. This mode is Deprecated and Audit should be used instead.
- Author: Keijo Korte, Louis-Maximilien Dupouy
- License: AGPL-V3
- Data Types:
thehive:case_artifact
