Microsoft Defender for Endpoint - Release Machine from Isolation

This workflow appears in the pivot menu and allows a user to release a machine from isolation in Microsoft Defender for Endpoint. Supported observables: Microsoft Defender Machine ID, hostname, IP address

Target: Microsoft Defender for Endpoint

Steps:

• Determine which observable type was provided:
  • If a Microsoft Defender Machine ID, set the local ID variable
  • If a hostname or IP, search for the machine and set the local ID variable (if a machine isn't found, end the workflow)
• Request the machine be released from isolation