Additional Configurations in Microsoft Defender for Endpoint
concept australia Updated Sep 10, 2026 1 min read additional-configurations-in-defender.md
The Microsoft Defender for Endpoint integration supports running additional actions beyond the standard actions.
The Microsoft Defender for Endpoint supports the following additional configurations:
- Configure Isolate Host capability in Microsoft Defender for Endpoint
Isolate the host from accessing the network in Microsoft Defender for Endpoint based on the severity of the attack. Isolating the host from the network enables you to prevent any other malicious activities or potential attacks on other hosts. - Configure Remove Host Isolation capability in Microsoft Defender for Endpoint
If needed, remove the isolation of a host that was previously isolated from the network in Microsoft Defender for Endpoint. You can prevent any other malicious activities or potential attacks on other hosts. - Configure Run Antivirus Scan capability in Microsoft Defender for Endpoint
Remotely initiate an anti virus scan to help identify and remediate malware that might be present on a compromised device. Run the scan as part of the investigation or response process. - Configure Restrict App Execution capability in Microsoft Defender for Endpoint
To contain an attack, restrict or lock a device and prevent subsequent attempts of potentially malicious programs from running. - Configure Remove App Restriction capability in Microsoft Defender for Endpoint
If needed, remove the restrictions of any application on the device. - Configure Get Related Machines from Defender Capability in Microsoft Defender for Endpoint
Get the list of related machines of specific observables. - Configure Stop and Quarantine File capability in Microsoft Defender for Endpoint
Stop and quarantine files from the Microsoft Defender platform.
Parent Topic:Microsoft Defender for Endpoint integration
38 lines · 4.0 KB
--- title: Additional Configurations in Microsoft Defender for Endpoint description: The Microsoft Defender for Endpoint integration supports running additional actions beyond the standard actions. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/additional-configurations-in-defender.html release: australia product: Security Incident Response classification: security-incident-response topic_type: concept last_updated: "2026-09-10" reading_time_minutes: 1 breadcrumb: [Microsoft Defender for Endpoint integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations] --- # Additional Configurations in Microsoft Defender for Endpoint The Microsoft Defender for Endpoint integration supports running additional actions beyond the standard actions. The Microsoft Defender for Endpoint supports the following additional configurations: - **[Configure Isolate Host capability in Microsoft Defender for Endpoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/isolate-host-ms-defender-for-endpoint.md)** Isolate the host from accessing the network in Microsoft Defender for Endpoint based on the severity of the attack. Isolating the host from the network enables you to prevent any other malicious activities or potential attacks on other hosts. - **[Configure Remove Host Isolation capability in Microsoft Defender for Endpoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/remove-isolation-ms-defender-for-endpoint.md)** If needed, remove the isolation of a host that was previously isolated from the network in Microsoft Defender for Endpoint. You can prevent any other malicious activities or potential attacks on other hosts. - **[Configure Run Antivirus Scan capability in Microsoft Defender for Endpoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/run-antivirus-scan-capability-ms-defender.md)** Remotely initiate an anti virus scan to help identify and remediate malware that might be present on a compromised device. Run the scan as part of the investigation or response process. - **[Configure Restrict App Execution capability in Microsoft Defender for Endpoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/restrict-app-execution-capability-ms-defender.md)** To contain an attack, restrict or lock a device and prevent subsequent attempts of potentially malicious programs from running. - **[Configure Remove App Restriction capability in Microsoft Defender for Endpoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/remove-app-restriction-capability-ms-defender.md)** If needed, remove the restrictions of any application on the device. - **[Configure Get Related Machines from Defender Capability in Microsoft Defender for Endpoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/get-related-machines-defender-capability-ms-defender.md)** Get the list of related machines of specific observables. - **[Configure Stop and Quarantine File capability in Microsoft Defender for Endpoint](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/stop-and-quarantine-file-capability.md)** Stop and quarantine files from the Microsoft Defender platform. **Parent Topic:**[Microsoft Defender for Endpoint integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/microsoft-defender-for-endpoint-integration.md)
| title | Additional Configurations in Microsoft Defender for Endpoint |
| description | The Microsoft Defender for Endpoint integration supports running additional actions beyond the standard actions. |
| locale | en-US |
| canonical_url | https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/additional-configurations-in-defender.html |
| release | australia |
| product | Security Incident Response |
| classification | security-incident-response |
| topic_type | concept |
| last_updated | 2026-09-10 |
| reading_time_minutes | 1 |
| breadcrumb | Microsoft Defender for Endpoint integrationSecurity Incident Response integrationsSecurity Incident ResponseEnterprise security case management applicationsSecurity Operations |