Defender ATP Demo - not seeing Auomated Investigations...? OS is not supported

I have Defender ATP running fine in a Demo.microsoft.com Tenant - with a Windows 10 Client connected to it and validated nicely - after unzipping some virus's and messing around with mimikatz I have ...

Benny Lakunishok
May 02, 2018
It is not supported as we require Windows 10, version 1803 (spring creators update).

We are working on enhancing the automation capabilities to also automate isolation, so it is on the road map (I can't commit to when just yet).

David Caddick

Iron Contributor

May 03, 2018

Thanks Benny,

I'm just reviewing some of the details that the Investigation goes thru + the fact that it's taking quite some time to run thru all the logs (having said that this is a Test VM in Hyper-V on my laptop - so the speed is not great - now strongly considering adding a second SSD for VM's to run from)

It might be useful to have an Alert at the Users end "Your PC has detected some potentially malicous files and is now running an Automated Investigation by Windows Defender ATP" ??

OR - once we can add an option to automatically isolate this - "Your PC has detected some potentially malicous files and has now been placed in Quarantine pending an Automated Investigation by Windows Defender ATP - you will only be able to use Outlook & Skype until complete"

Ideally this would still allow Quick Assist? the Message could be customized with the Corporate logo + Help Desk contact details & a link to start Quick Assist?

Benny Lakunishok

Former Employee

May 07, 2018

Thanks for the suggestions David.
These are ideas we are already considering.

Let me know if you need anything else.

Forum Discussion

Defender ATP Demo - not seeing Auomated Investigations...? OS is not supported