07-29-2020 08:53 AM
07-31-2020 10:20 AM
Good morning @agattsek ,
I can validate that isolate and unisolate are listed on the timeline, but I was unable to find those specific events within advanced hunting today.
I tried to find something in the timeline that corresponded with the isolation event (i.e. a process launch or whatnot), but was unable to find a reliable indicator.
08-05-2020 08:12 AM
@agattsek We had a blog that posted recently that shows how you can see the isolation actions in the Action Center. It's not a query, but might solve the need another way: https://techcommunity.microsoft.com/t5/microsoft-threat-protection/the-action-center-in-microsoft-th...