Trigger the Microsoft Defender for Endpoint from Configuration Item related list

---
title: Trigger the Microsoft Defender for Endpoint from Configuration Item related list
description: Trigger a capability profile manually from the configuration item related list.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/security-incident-response/trigger-ms-defender-endpoint-profile-ci-relatedlist.html
release: australia
product: Security Incident Response
classification: security-incident-response
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Microsoft Defender for Endpoint integration, Security Incident Response integrations, Security Incident Response, Enterprise security case management applications, Security Operations]
---

# Trigger the Microsoft Defender for Endpoint from Configuration Item related list

Trigger a capability profile manually from the configuration item related list.

## Before you begin

Role required: sn\_si.admin or sn\_si.analyst

## Procedure

1.  Navigate to **Security Incidents** > **Show All Incidents**.

2.  Select the security incident that you want to review with the Microsoft Defender for Endpoint information.

3.  Click **Show All Related Lists**.

4.  Click the Configuration Item related list.

5.  Select the added configuration items.

6.  From the **Actions** on selected rows, select a capability.

    The selected capability is triggered manually.

7.  Validate the work notes and activities section.

8.  View the tags, and validate the data in the related lists.