Triage and respond to Microsoft Defender alerts with Jira and isolation
Build a workflow that retrieves Microsoft Defender alerts and creates a Jira ticket for each. Message the affected user via Teams to confirm activity, trigger an antivirus scan and an investigation-package collection on the device, and attach results to the Jira ticket. If criteria are met, isolate the machine with Defender. Handle offline devices, package-collection timeouts, and API errors, and require approval before isolation. Output the ticket, collected evidence, and isolation status.
What this prompt builds
Turn Defender alerts into Jira tickets, run AV scans and forensic collection, and isolate hosts when needed.
The problem
Defender alerts need consistent triage, evidence collection, and sometimes containment, but doing this by hand across the portal and ticketing is slow under load. Delays let confirmed threats persist on endpoints.
Solution and impact
This workflow pulls Defender alerts, opens Jira tickets, prompts the user, runs an AV scan, collects an investigation package, and isolates the host if required, attaching results to Jira. Endpoint alerts get full triage-to-containment handling with an audit trail.