---
title: "Response Actions for Microsoft Defender for Endpoint"
slug: "response-actions-for-microsoft-defender-for-endpoint"
updated: 2026-09-09T16:09:29Z
published: 2026-09-09T16:09:29Z
canonical: "docs.redcanary.com/response-actions-for-microsoft-defender-for-endpoint"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Response Actions for Microsoft Defender for Endpoint

Zscaler MDR [Automation](/doc/docs/automation) provides the following response actions for Microsoft Defender for Endpoint (MDE):

**Ban File Hashes (IOC)** Ban file hashes across your organization that are marked as indicators of compromise (IOCs).

**Isolate the Endpoint (Full)** Isolate the endpoint by preventing all network activity.

**Isolate the Endpoint (Selective)** Isolate the endpoint by limiting network activity while honoring actively configured [Isolation Exclusion Rules](https://learn.microsoft.com/en-us/defender-endpoint/isolation-exclusions) in MDE (falls back to full isolation if no rules exist).

**Deisolate the Endpoint** De-isolate the endpoint by re-allowing network activity.

**Cancel Queued (De)Isolation**

Cancel a queued **Isolate** or **De-isolate** action on an endpoint in both Zscaler MDR and your MDE environment, preventing further attempts to run the action in both platforms.

**Quarantine Files (IOC)** Stop and locally isolate files on an endpoint that were marked as indicators of compromise (IOC).

**Restrict App Execution (Endpoint)** Restrict execution of applications on the endpoint to OS-approved signed binaries.

**Allow App Execution (Endpoint)** Unrestrict application execution on the endpoint by allowing unsigned apps to execute.

**Collect Forensics** [Collect a forensic package](/doc/docs/collect-a-forensics-package) on an endpoint.

**Ban IP Addresses (IOC)** Ban IP addresses across your organization that are marked as indicators of compromise (IOCs).

**Ban Domains (IOC)** Ban domains across your organization that are marked as indicators of compromise (IOCs).

## Prerequisites

- You have an active [Defender for Endpoint integration](/doc/docs/integrate-red-canary-to-microsoft-defender-for-endpoint)

## Adding a Microsoft Defender for Endpoint Response Action to a Playbook

The steps below demonstrate how to add the **Isolate an Endpoint (Selective)** response action.

1. From the Zscaler MDR portal navigation menu, select **Automation > Playbooks**.
2. In the Playbooks section, open an existing playbook or create a new one by clicking **+Create New Playbook**.
3. Name the playbook (if applicable), then click **+Add Action**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/MDEResponseActions-2_01.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A25Z&se=2026-11-09T12%3A54%3A25Z&sr=c&sp=r&sig=eBDW%2Br0YsHkFA35hVbB%2F1Bv%2Blx45akPgEZdN5C%2FoMHw%3D)
4. Click **Isolate the Endpoint (Selective)**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/MDEResponseActions-2_02.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A25Z&se=2026-11-09T12%3A54%3A25Z&sr=c&sp=r&sig=eBDW%2Br0YsHkFA35hVbB%2F1Bv%2Blx45akPgEZdN5C%2FoMHw%3D)
5. Check the **I acknowledge…** box.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/MDEResponseActions-2_03.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A25Z&se=2026-11-09T12%3A54%3A25Z&sr=c&sp=r&sig=eBDW%2Br0YsHkFA35hVbB%2F1Bv%2Blx45akPgEZdN5C%2FoMHw%3D)
6. [OPTIONAL] Check the **Require Approval** box and provide contact details if you want someone to approve this action before it executes. This will apply to both manual and automatically triggered executions.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/MDEResponseActions-2_04.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A25Z&se=2026-11-09T12%3A54%3A25Z&sr=c&sp=r&sig=eBDW%2Br0YsHkFA35hVbB%2F1Bv%2Blx45akPgEZdN5C%2FoMHw%3D)
7. Click **Save**.

## Manually Executing the Response Action

To execute a response action manually:

1. Open the playbook and click **Run**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/MDEResponseActions-3_01.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A25Z&se=2026-11-09T12%3A54%3A25Z&sr=c&sp=r&sig=eBDW%2Br0YsHkFA35hVbB%2F1Bv%2Blx45akPgEZdN5C%2FoMHw%3D)
2. Select a Threat or Endpoint to execute against, then click **Run**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/MDEResponseActions-3_02.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A25Z&se=2026-11-09T12%3A54%3A25Z&sr=c&sp=r&sig=eBDW%2Br0YsHkFA35hVbB%2F1Bv%2Blx45akPgEZdN5C%2FoMHw%3D)
3. Click **Follow along with the progress here**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/MDEResponseActions-3_03.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A25Z&se=2026-11-09T12%3A54%3A25Z&sr=c&sp=r&sig=eBDW%2Br0YsHkFA35hVbB%2F1Bv%2Blx45akPgEZdN5C%2FoMHw%3D)
4. If you checked the **Require Approval** option, you’ll need to click **Approve and Continue**.![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/MDEResponseActions-3_04.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A25Z&se=2026-11-09T12%3A54%3A25Z&sr=c&sp=r&sig=eBDW%2Br0YsHkFA35hVbB%2F1Bv%2Blx45akPgEZdN5C%2FoMHw%3D)
5. Click **History** in the playbook settings menu to review the execution details. These details are also displayed on the threat timeline, endpoint activity timeline, and in audit logs. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/MDEResponseActions-3_05.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A25Z&se=2026-11-09T12%3A54%3A25Z&sr=c&sp=r&sig=eBDW%2Br0YsHkFA35hVbB%2F1Bv%2Blx45akPgEZdN5C%2FoMHw%3D)

## Automatically Executing the Response Action

To execute the response action automatically, link an appropriate trigger to the playbook. For more information, see [Customize When a Playbook is Run With Triggers](/doc/docs/customize-when-a-playbook-is-run-with-triggers).