How to Configure Microsoft Defender for Endpoint (MDE) Automated Investigation and Response (AIR) Playbooks

In modern enterprise security, the sheer volume of alerts generated by Endpoint Detection and Response (EDR) sensors makes manual triage mathematically impossible. If a Security Operations Center (SOC) analyst must manually isolate a machine, pull a memory dump, investigate a suspicious binary, and remediate registry keys for every single malware alert, true zero-day threats will be missed in the noise.

To solve this, Microsoft Defender for Endpoint (MDE) includes Automated Investigation and Response (AIR). Utilizing a cloud-based AI engine, AIR acts as a virtual Level 1 SOC analyst. When an alert triggers, AIR automatically initiates an investigation playbook, inspecting files, processes, services, and network connections on the compromised endpoint, and then autonomously executing remediation actions to neutralize the threat.

This guide explains how AIR operates architecturally and how to configure Device Groups and Automation Levels to safely deploy AIR across an enterprise.

Understanding AIR Architecture

When an MDE sensor on a Windows endpoint detects malicious behavior (e.g., a PowerShell script attempting to inject into lsass.exe), it generates an alert. If the device is configured for AIR, this alert triggers an Automated Investigation.

The investigation engine executes the following steps:

1. Evidence Collection: MDE pulls telemetry from the endpoint, looking for related files, scheduled tasks, and IP connections associated with the alert.
2. Verdict Generation: The engine queries Microsoft’s global Threat Intelligence graph to determine if the collected entities are Malicious, Suspicious, or Clean.
3. Remediation: Based on the verdicts, AIR formulates a remediation plan (e.g., “Quarantine malware.exe and delete Scheduled Task X”).
4. Execution: Depending on the configured Automation Level, AIR either executes the remediation instantly or pauses and asks a human analyst for approval in the Action Center.

Step 1: Establishing Device Groups

You should never deploy fully autonomous remediation uniformly across an entire organization. Quarantining a false-positive file on a user’s laptop is an inconvenience; quarantining a false-positive file on a production Active Directory Domain Controller is a catastrophic outage.

Therefore, AIR is configured via Device Groups. We will create two groups: one for standard workstations (fully automated) and one for servers (requiring manual approval).

1. Navigate to the Microsoft Defender portal (security.microsoft.com).
2. Go to Settings > Endpoints > Device groups.
3. Click + Add device group.

Create the Workstation group:

• Name: Standard Windows Workstations
• Automation level: Full – remediate threats automatically (This allows AIR to quarantine files and kill processes without asking for human permission).
• Matching rules: Set the rule where OS equals Windows 10 or Windows 11.

Create the Server group:

• Name: Mission-Critical Servers
• Automation level: Semi – require approval for any remediation (AIR will do the investigation, but a human must click “Approve” before any file is deleted).
• Matching rules: Set the rule where OS equals Windows Server.

Ensure the Device Groups are ranked correctly (Server group above Workstation group) to prevent overlap conflicts.

Step 2: Monitoring an Automated Investigation

Once configured, the next time a threat is detected on a workstation, AIR will trigger. To view the AI’s logic and actions:

1. In the Defender portal, navigate to Incidents & alerts > Investigations.
2. Click on an active or completed investigation.

The Investigation Graph will display exactly what the AI did. You will see tabs for:

• Alerts: The original trigger.
• Evidence: Every file, IP, and process the AI analyzed during the playbook execution.
• Entities: The specific endpoints involved.
• Log: A step-by-step chronological record of the AI’s actions (e.g., “Analyzed 43 files. Found 1 malicious file. Quarantined file successfully.”)

Step 3: Handling the Action Center (Semi-Automated)

If a threat triggers on a machine in the Mission-Critical Servers group, the AI will perform the entire investigation but will halt before executing the remediation payload.

To approve the action:

1. Navigate to the Action center in the Defender portal.
2. Look under the Pending tab.
3. You will see a request from the AIR engine (e.g., “Quarantine file crypto.exe on PROD-SQL-01“).
4. Review the evidence. If the analyst agrees it is malicious, click Approve. MDE will immediately send the command to the server to execute the remediation.

Step 4: Configuring Automation Folder Exclusions

Sometimes, developers or IT administrators use custom administrative scripts that trigger false positives in MDE. If AIR is set to Full Automation, it will relentlessly quarantine these scripts.

You can configure Automation Exclusions to prevent AIR from taking action on specific paths or file hashes, while still allowing the initial alert to trigger for visibility.

1. Go to Settings > Endpoints > Rules > Automation folder exclusions.
2. Click New folder exclusion.
3. Enter the path (e.g., C:\IT_Scripts\) and provide a justification. AIR will no longer autonomously delete files executing from this directory.

Conclusion

Deploying MDE Automated Investigation and Response is the key to scaling a Security Operations Center. By carefully balancing Full Automation on standard endpoints with Semi-Automation on fragile servers, organizations can drastically reduce their Mean Time to Remediate (MTTR) while ensuring critical infrastructure remains protected from both malware and overzealous AI remediation.