Skip to content

Update advanced-hunting-take-action.md with query reference #406

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mattiasborg82 wants to merge 1 commit into
base: public
Choose a base branch
from
Open

Update advanced-hunting-take-action.md with query reference #406

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions defender-xdr/advanced-hunting-take-action.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,17 @@ Apart from device-focused remediation steps, you can also take some actions on e

**Initiate automated investigation** might be disabled if mandatory columns are missing. To resolve this issue, select **Show empty columns** before you select **Take actions**.

See the following query as reference to enable *Submit to Microsoft* and *Initiate automated investigation*

```kusto
EmailEvents
| where ThreatTypes contains "spam"
| project Timestamp, NetworkMessageId,RecipientEmailAddress,SenderFromAddress,SenderMailFromAddress,Subject,SenderFromDomain,TimeGenerated,SenderIPv4,SenderIPv6
| join EmailUrlInfo on NetworkMessageId
```



:::image type="content" source="media/advanced-hunting-take-actions-choose-actions.png" alt-text="Screenshot of the Choose actions page of the Take actions wizard with Initiate automated investigation selected." lightbox="media/advanced-hunting-take-actions-choose-actions.png":::

You can also provide a remediation name and a short description of the action taken to easily track it in the action center history. You can also use the Approval ID to filter for these actions in the action center. This ID is provided at the end of the wizard:
Expand Down