Defender ATP Demo - not seeing Auomated Investigations...? OS is not supported

[David Caddick]

I have Defender ATP running fine in a Demo.microsoft.com Tenant - with a Windows 10 Client connected to it and validated nicely - after unzipping some virus's and messing around with mimikatz I have some good stats and alerts to show everything is working as advertised.

I was also quietly impressed with the way it was actually able to "isolate" the Win 10 client.
Question - can this be automated as well?

Main Question - the "Automated Investigation" area is still completely blank....???
It seems I'm still getting an error that this OS is not supported?
This is build 1709...? Please see attached files for screenshots

I have also now tried with a couple of other Windows 10 images, but overnight they updated them selves to 1709 also, how can I get the Automated Investigation element working correctly? It would appear that Build 1709 is not a supported OS? If that is the case then what is supported...?

I am confused on this - any advice on where to look next?

Thanks in advance
Dave Caddick
Dave Caddick

[#2 · Accepted solution]

It is not supported as we require Windows 10, version 1803 (spring creators update).

We are working on enhancing the automation capabilities to also automate isolation, so it is on the road map (I can't commit to when just yet).

[#3]

Thanks Benny,  We got that sorted yesterday and now working a treat.

Having said that - it seems that the "Automated Investigation" is stalling even though I can clearly see that Defender on the end point has already Quarantined/Deleted the malicious file?

Is this something that needs to be troubleshooted? Any advice?

[#4]

Can you give some more details as to what do you mean by stalling?

[#5]

Hi Ben, I have an alert for:
"Windows Defender AV detected 'Tiggre' malware" that has now been running for 2h 45mins...?

[#6]

I need to get some more details on why has it been running so long, is the investigation pending as it is waiting for the machine? waiting for a pending action approval?
Can you check the log and see what is the latest action it is performing or pending?

[#7]

Maybe I'm doing something stupid, but that's the info I'm after too 

I can see it's gathered 52 logs - they are all listed as completed.

Opps... - now I can see on the right that I needed to check the status "Queued" - there are 2 of these

It's waiting to Read File - on the machine's C drive - and this is actually the OnBoarding.cmd file...

So even though I have now been able to view the file contents (assuming this means it has successfully retrieved the file?) and this process is still listed as being Queued??

Feel free to let me know what else I should be checking?

[#8]

Thanks Benny,

I'm just reviewing some of the details that the Investigation goes thru + the fact that it's taking quite some time to run thru all the logs (having said that this is a Test VM in Hyper-V on my laptop - so the speed is not great - now strongly considering adding a second SSD for VM's to run from)

It might be useful to have an Alert at the Users end "Your PC has detected some potentially malicous files and is now running an Automated Investigation by Windows Defender ATP" ?? 

OR - once we can add an option to automatically isolate this - "Your PC has detected some potentially malicous files and has now been placed in Quarantine pending an Automated Investigation by Windows Defender ATP - you will only be able to use Outlook & Skype until complete"

Ideally this would still allow Quick Assist? the Message could be customized with the Corporate logo + Help Desk contact details & a link to start Quick Assist? 

[#9]

Thanks for the suggestions David.
These are ideas we are already considering.

Let me know if you need anything else.