Microsoft Defender for Endpoint: Contain Hosts

This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench.

This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the Enable an Auto Remediation in Workbench guide to finish your setup.

How It Works

If our SOC identifies a host that must be contained, Workbench completes the action automatically. You have the option to restrict these actions to specific hosts by configuring an allow or deny list (the hosts must first be added as context, and then the list can be configured in Workbench; see Step 2).

Endpoints Used

Microsoft Defender for Endpoint API

base https://api.securitycenter.windows.com , full isolation

Method	Endpoint	Purpose
GET	api/machines?$filter=contains(computerDnsName, '{hostname}')	Resolve hostname to machine ID (skipped if an asset ID is supplied)
GET	api/machineactions?$filter=...	Pre-check: read most recent isolate/unisolate action state
POST	api/machines/{machineId}/isolate	Isolate the device
GET	api/machineactions?$filter=...	Poll action status until the containment completes
GET	api/machines/{machineId}	Fetch lastSeen for logging

Revert (release from containment): POST api/machines/{machineId}/unisolate , or POST api/machineactions/{machineActionId}/cancel if an isolate action is still pending.

Step 1: Allow Appropriate Permissions in Your EDR Console

Microsoft Defender for Endpoint customers have two options to activate the appropriate permissions needed to allow Workbench to support Host Containment.

Option 1: Allow appropriate permissions in your EDR console

1. Make sure you select Grant admin consent within the Expel Defender for Endpoint Integration > API Permissions tab and consent to the new API permissions.

Option 2: Create Custom Microsoft Entra ID application

1. Make sure you assign all required permissions in the Microsoft Defender for Endpoint Setup for Workbench guide.
2. Add the machine.isolate Windows Defender permission.
3. Grant admin consent.

   

Step 2: Update Your Context

If you do not want to specify any hosts for a "do not contain" or "always contain" list, and instead wish for Expel to automatically contain all identified hosts, skip to Step 3.

Working with your Customer Success Manager, prepare to create an allow or deny list by adding hosts as org context for your environment. You will then be able to select those hosts as "Never contain" or "Always contain" assets when you enable the auto remediation in Workbench. In this instance, the context update process is usually accomplished by sending us a .csv file.

If our SOC identifies a host that must be contained and you have created either an allow ("Always contain") or deny ("Never contain") list in Workbench, any hosts falling outside of those parameters are assigned to you as actions rather than being contained automatically.

Step 3: Return to the Main Setup Guide

Your Microsoft Defender for Endpoint device is now ready for the Contain Hosts auto remediation. You should now do one of the following:

• If you do not need to set up any other devices for this auto remediation, you can return to the Enable an Auto Remediation in Workbench guide to finish Step 2 of the process.
• If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations, be sure to complete those setup guides as well before returning to the Enable an Auto Remediation in Workbench guide to finish Step 2 of the process. Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.