6.3 Dealing with Ransomware via Sentinel automation, MDE from Zero to Hero

[@sameershetty1527]

What if I dont want to fully isolate the endpoint I want users to have the option to communicate via teams & outlook but rest everything blocked
As this option is available when we do manual isolation from defender portal
Which action should we select for trigger isolation in logic apps

[@osho0001]

Please clarify why we required sentinel to isolate, if there is any malware found defender has capability to identify and isolate the device right

[@vipuldabhi6971]

How to get this wannacry files from??

[@jacksonfeldencloudsecurity]

You can find it by searching for "the Zoo - A Live Malware Repository" on GitHub.
Please BE CAREFUL, they are real malware and ransomware.