| title | incidentTask: executeResponseAction |
|---|---|
| description | Execute a remediation action in Microsoft Defender XDR to resolve a security incident. |
| author | BenAlfasi |
| ms.date | 05/07/2025 |
| ms.localizationpriority | medium |
| ms.subservice | security |
| doc_type | apiPageType |
Namespace: microsoft.graph.security
[!INCLUDE beta-disclaimer]
Execute a remediation action on a Microsoft Defender XDR incident task. Only the following actionType values are supported for automated execution: collectInvestigationPackage, isolateDevice, unRestrictAppExecution, unIsolateDevice, restrictAppExecution, runAntiVirusScan, stopAndQuarantineFile, submitIocRule.
[!INCLUDE national-cloud-support]
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.
[!INCLUDE permissions-table]
[!INCLUDE rbac-security-alerts-apis-write]
POST /security/incidentTasks/{incidentTaskId}/executeResponseAction| Name | Description |
|---|---|
| Authorization | Bearer {token}. Required. |
Don't supply a request body for this method.
If successful, this method returns a 204 No Content response code. If a status code other than 2xx or 404 is returned or if a provider times out, see Microsoft Graph Security API error responses.
Note
Attempting to execute a response action with an unsupported actionType will return a 400 Bad Request error with the message "Currently {incidentTask.ActionType} is not supported".
POST https://graph.microsoft.com/beta/security/incidentTasks/213213/executeResponseAction[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
[!INCLUDE sample-code] [!INCLUDE sdk-documentation]
HTTP/1.1 204 No Content