Skip to main content
Windows Defender ATP app icon

Windows Defender ATP

This app integrates with Windows Defender Advanced Threat Protection(ATP) to execute various containment, corrective and investigative actionsBuilt by Splunk LLC
soar product badge
Default Version 3.2.0

September 17, 2021

Compatibility

SOAR On-Prem, SOAR Cloud

Platform Version: 5.5, 5.4, 5.3, 5.2, 5.1, 5.0, 4.10, 4.9

Rating
0
(0)

Log in to rate this app

Support
Splunk Supported
Ranking

#3 in Endpoint

This app integrates with Windows Defender Advanced Threat Protection(ATP) to execute various containment, corrective and investigative actions

Supported actions

  • test connectivity: Validate the asset configuration for connectivity using the supplied configuration
  • quarantine device: Quarantine the device
  • unquarantine device: Unquarantine the device
  • get status: Get status of the event on a machine
  • scan device: Scan a device for virus
  • quarantine file: Quarantine a file
  • list devices: List of recently seen devices
  • list alerts: List all alerts of a given type
  • list sessions: List all logged in users on a machine