Take response actions in Microsoft Defender ATP

Applies to:

Want to experience Microsoft Defender ATP? Sign up for a free trial.

You can take response actions on machines and files to quickly respond to detected attacks so that you can contain or reduce and prevent further damage caused by malicious attackers in your organization.


The machine related response actions are only available for machines on Windows 10 (version 1703 or higher), Windows Server, version 1803 and Windows Server 2019.

In this section

Topic Description
Take response actions on a machine Isolate machines or collect an investigation package.
Take response actions on a file Stop and quarantine files or block a file from your network.