Configuring Automated Investigation Packages in Microsoft Defender for Endpoint

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender for Endpoint

Short answer

B Configure an automated alert response in Microsoft Defender for Endpoint to automatically investigate malware alerts and collect forensic investigation packages with minimal administrative effort.

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. All client computers run Windows 11 and are onboarded to Microsoft Defender for Endpoint.
You have an Azure subscription that contains a Microsoft Sentinel workspace.
You need to ensure that when malware is detected on a Windows 11 computer, an investigation package is collected. The solution must minimize administrative effort.
What should you configure?
  1. an automation rule
  2. an automated alert response in Defender for Endpoint Correct Answer
  3. an endpoint security policy
  4. a custom detection rule

Key Takeaways

The trap is confusing Microsoft Sentinel automation rules (for workflow orchestration) with Microsoft Defender for Endpoint's native Automated Investigation and Response (for forensic data collection).

Learn how to configure Microsoft Defender for Endpoint's Automated Alert Response to automatically collect investigation packages when malware is detected, minimizing admin effort.

Common mistake: Choosing 'automation rule' (A) because candidates assume all automation happens in Sentinel. However, Sentinel rules cannot natively collect endpoint forensic packages without complex integrations, violating the 'minimize administrative effort' constraint.

Expert Analysis

The boundary between Defender XDR automation rules and MDE Automated Alert Response

The question asks to minimize administrative effort while collecting an investigation package upon malware detection on a Windows 11 endpoint. The key distinction lies in the scope of action: Microsoft Sentinel automation rules orchestrate cross-product workflows (e.g., creating tickets, sending emails), whereas Microsoft Defender for Endpoint (MDE) Automated Alert Response (AIR) handles native, built-in incident response actions directly within the endpoint security product.

Why Option B is correct: Microsoft Defender for Endpoint includes a feature called Automated Investigation and Response. When configured, it automatically investigates alerts, including malware detections. A core part of this automated investigation is the collection of an Investigation Package—a ZIP file containing forensic artifacts like running processes, network connections, and registry keys. This is a native capability of MDE that requires zero custom scripting or external tool integration. Since the endpoints are already onboarded to MDE, enabling AIR is a policy setting with minimal administrative overhead. As noted in the comments, "Defender for Endpoint can automatically trigger an investigation... It can collect an investigation package from the affected device." This fits the requirement perfectly.

Why Option A is incorrect: Automation rules in Microsoft Sentinel are designed to manage incident lifecycle events (like changing status or assigning users) across the SIEM platform. They do not natively have the ability to reach down into an endpoint and collect forensic packages without triggering an API call to another service (like MDE). This would require configuring Logic Apps or Playbooks, which increases administrative effort significantly compared to the native MDE feature.

Why Options C and D are incorrect: Endpoint Security Policies define configuration baselines (e.g., firewall settings, attack surface reduction rules) but do not trigger investigative data collection upon alerting. Custom Detection Rules define what triggers an alert; they do not define the post-detection response action of collecting an investigation package.

Exam Strategy

When a question specifies 'minimize administrative effort' and involves collecting forensic data from an endpoint, look for native capabilities within the endpoint protection platform first. Avoid solutions that require integrating with a SIEM (Sentinel) unless the scenario explicitly demands cross-platform correlation or ticketing. Remember that MDE's Automated Investigation and Response is a built-in, low-effort feature for malware forensics.

Frequently Asked Questions

What is an Investigation Package in Microsoft Defender for Endpoint?

An Investigation Package is a compressed ZIP file containing forensic data collected by MDE during an automated investigation. It includes details like running processes, network connections, and registry changes to help analysts understand the threat context.

Can Microsoft Sentinel Automation Rules collect investigation packages directly?

No. Sentinel Automation Rules manage incident states and notifications. To collect an investigation package via Sentinel, you would need to create a custom playbook (Logic App) that calls the MDE API, which adds significant administrative complexity.

More SC-200 FAQ →

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. techghostbarbie 👍 2 Answered B
    B. an automated alert response in Defender for Endpoint Why this is correct In Microsoft Defender for Endpoint, you can configure Automated Investigation and Response (AIR) capabilities. When malware is detected: Defender for Endpoint can automatically trigger an investigation It can collect an investigation package from the affected device This is built-in and requires minimal configuration This directly satisfies: ✅ Automatic action on malware detection ✅ Minimal administrative effort
  2. Provost 👍 1 Answered B
    The investigation package is an MDE artifact, and MDE's automated response (AIR) handles it natively and automatically on a malware alert with default-on configuration — minimizing administrative effort. A is wrong because Sentinel automation rules orchestrate incident handling and would have to call into MDE to collect a package, which is more effort, not less. C (endpoint security policy) configures protection settings, and D (custom detection rule) builds a new detection rather than responding to an existing one
  3. b0a2cd6 👍 1 Answered A
    In Extended Detection and Response (XDR) platforms like Microsoft Defender XDR, automated rules (such as custom detection or automation rules) can trigger the collection of an investigation package. This package compiles forensic data from an endpoint—such as autoruns, running processes, and network connections—into a ZIP file
  4. Anarckii 👍 1 Answered D
    automation rules dont take action. Custom Detection can be configured to do something

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Assigning the Microsoft Sentinel Responder role so a user can investigate incidents under least privilege

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide