Defender for Endpoint response: isolate device, restrict app execution, run antivirus scan, collect investigation package, live response, stop and quarantine file, file indicators, device timeline

When an endpoint is involved in an incident, Microsoft Defender for Endpoint (MDE) gives you response actions on the device page and on file pages. Knowing which one fits the situation is a core SC-200 skill, because each action trades containment against disruption to the user. Device actions appear in the top-right menu of the device page; file actions appear on the file page you reach from an alert, the device timeline or a search.