Microsoft Defender: Automated investigation and response (AIR) integrated into antivirus with manual triggering removed

🚨 The Signal: Microsoft Defender's Automated Investigation and Response (AIR) will no longer be a separate, manually triggered experience. Its capabilities are now fully integrated into always-on antivirus, automating detection and response by default, enhancing endpoint protection.

The Impact

Security teams are affected by the removal of manual AIR triggering, reducing the need for manual intervention in incident response.

• Security Teams: Reduced manual effort for incident response.
• Admins: Simplified security workflow due to automated processes.

The Action

1. Review existing security playbooks and incident response procedures to account for the automated AIR functionality.
2. Familiarize security teams with the integrated detection and response capabilities within Microsoft Defender XDR.
3. Educate security analysts on how to initiate full antivirus scans for on-demand investigations, replacing the standalone AIR trigger.

Domain: Defender · Impact: medium · Workload: Microsoft Defender