Forum Discussion

Dhwani_Shah's avatar
Dhwani_Shah
Occasional Reader
Jun 08, 2026

Ways to fetch quarantine files

We are working with quarantine files and have a few questions:

1. Is there a public API available to retrieve quarantined files from Microsoft Defender for Endpoint?

2. Is there a documented method to map an alert or a file SHA-1/SHA-256 hash to the corresponding object in the Defender quarantine store?

3. Is there a way to retrieve quarantined files other than using a PowerShell script through the Live Response API?

No RepliesBe the first to reply