Observed Automation Discrepancies

Hi

Question 1: AIR Actions/decisions and Partial remediation

1. Signals (Defender Suite)
2. Correlation Engine classifying into incidents (grouped alerts)
3. AIR Automation Engine (virtual analyst playbooks)
4. Remediation Engine - Action Center (approve/reject/undo) - based on configuration
5. Attack Disruption - instant containment (high-confidence)

A partial outcome occurs when some remediation actions are completed while others remain pending approval, or when required endpoint protection components e.g Microsoft Defender Antivirus are not fully enabled.

Question 2: 

To review Go to the Microsoft Defender portal (https://security.microsoft.com/airinvestigation) → Investigations. You'll see every active and completed investigation with status, evidence analyzed, and actions taken/recommended.

Additional information on this Question: Use automated investigations to investigate and remediate threats - Microsoft Defender for Endpoint | Microsoft Learn