Prove MDE is working — first tool + proof field

1. Why “is MDE working?” is five questions

Operators collapse five failures into one sentence. The sensor is Inactive. The device page Last seen is days old. The Office-child ASR rule is in Audit. The alert is still New while the laptop sits on the LAN. Isolate device is Pending because the host is dark. Those are five first clicks.

This page is the night-shift desk for proof. The factory taught ASR Audit versus Block, risk versus isolate, and why a living-off-the-land alert is not a patch ticket. Here you learn the five Microsoft Defender portal surfaces you actually open, in order, when someone asks you to prove MDE is working — or to explain why it did not block.

Hero · five tiles, one ticket

2. Mental model — five proof tools

Memorise five named objects before you click. Each tool is allowed to prove one thing. Over-claiming a field is how you isolate a leftover renamed device or flip ASR tenant-wide at 02:00.

3. Decision flow — ticket → first tool

Flowchart first. Do not open Endpoint security policies or click Isolate device until a diamond says so.

Path · pick the branch before the menu

4. How to choose — first tool + proof field

Print this next to the Microsoft Defender portal. If you cannot recite the proof field, you are not ready to isolate or change a rule.

5. Runbook Side A → B → C

Side A proves the sensor is on the wire. Side B proves what MDE saw and whether policy was allowed to block. Side C proves the response click landed. On a messy Sev-2, do them in this order until a field lights up.

Side A — Device page (sensor health / last seen)

1. Open Assets → Devices, not the alert editor

   Path: Assets → Devices, or go directly to security.microsoft.com/machines. Search the hostname. If two rows appear after a reinstall or rename, Microsoft documents that a new device entity is created and the previous one stays Inactive — work the live name. Source: Explore devices in the device inventory; Fix unhealthy sensors.

2. Read the three sensor columns that close “is MDE working?”

   Sensor health state — Active (reporting), Inactive (no report for more than seven days in the past month), or Misconfigured (impaired communications / no sensor data). Last seen — last connection on the device page. Onboarding status — onboarded versus discovered / can be onboarded. Source: Check the device health; Device inventory columns.

3. If Inactive or Last seen is days, stop. This is a sensor ticket

   Do not start live response. Do not isolate and call it contained (a dark host retries isolate for up to three days, then gives up). Do not call it a miss. Check Sense / WinHTTP / proxy to Defender URLs, a rename leftover, or offboarding. Then come back.

4. If Misconfigured, quote the subtype before you hunt a “miss”

   Impaired communications = limited talk to the service. No sensor data = the device talks but only reports partial data. Official next checks: Internet + WinHTTP, service URLs, diagnostic data service, Defender Antivirus ELAM not disabled by policy. Empty Timeline is expected until that is fixed.

Side B — Alert / Incident, Timeline, ASR / next-gen protection

1. Open the alert, not Slack’s filename

   Path: Incidents & alerts → Alerts (security.microsoft.com/alerts), or the device Incidents and alerts tab. Official columns: short description, Severity (high / medium / low / informational), Status (New / In progress / Resolved), Classification (not set / false alert / true alert), investigation state, category, assignee, last activity. Source: Investigate devices; Investigate alerts in Microsoft Defender XDR.

2. Open Timeline before you type live response

   Device page → Timeline. Select the event → side panel with process tree. Quote parent, child, command line, and the MITRE technique (bold + blue icon). Additional information can say Remediation successful / unsuccessful, Suspicious script detected, or the alert category. Timeline is historical telemetry. Live response is live. Do not skip the tree to collect a file you already have in the graph.

3. If the ticket is “why didn’t it block?”, open Effective settings — then the ASR report

   Device page → Configuration management → Effective settings. Official: setting name, policy type, effective value, source (Defender / Intune / Group Policy / registry), last report time. Complex settings such as ASR rules break down each rule, its source, and exclusions. Then confirm detections: Reports → Endpoints → Attack surface reduction rules and the Blocked/Audited? column.

4. Also read Defender Antivirus mode. ASR needs Active

   Device health status card (highest-priority message includes Defender Antivirus not active). ASR rules require Microsoft Defender Antivirus in Active mode with real-time protection on — not Passive, not Limited periodic scanning, not Off. If AV is Passive, Audit/Block on an ASR policy will not do what the ticket expects. That is configuration, not a product miss. Source: ASR rules overview — Requirements.

Path:            Incidents & alerts → Alerts   (or device Incidents and alerts)
Quote:           Severity + Status + Classification
Then:            Device → Timeline  (parent → child → MITRE + Additional information)
If “no block”:   Device → Effective settings   and/or
                 Reports → Endpoints → Attack surface reduction rules
Quote:           ASR rule mode Audit vs Block   ·  Blocked/Audited?
Also quote:      Device health status · Defender Antivirus Active / Passive
If empty queue:  Assets → Devices · Sensor health state / Last seen first

Side C — Action center (isolate / collect / live response)

1. Isolate a live egress host from the device page — prove it in Action center

   Response actions sit along the top of the device page: Isolate device, Restrict app execution, Run antivirus scan, Collect investigation package, Initiate live response session, Action center. Official isolate: type a comment → Confirm. Isolation disconnects the device from the network while it stays connected to the Defender service. You need the Active remediation actions role and device-group access. Isolation is automatically lifted after seven days. Microsoft’s word on the device is Isolate device (Contain device is a different action for unmanaged hosts). Source: Take response actions on a device.

2. Do not trust the button. Open Action center

   Path: device → Action center, or security.microsoft.com/action-center. Tabs: Pending (approve / reject) and History. Quote action type, submission time, submitting user, and whether it succeeded or failed. If the host was offline, Microsoft retries isolate for up to three days — Pending is not Isolated.

3. Live response and collect only after Last seen is seconds

   Initiate live response session needs a talking sensor. Collect investigation package can fail on low battery or a metered link — the zip is downloaded from Action center when the package is available. Both are change-control in most shops. A dark Inactive device does not collect tonight.

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only.

Journey · one amber hop is the ticket

MDE-ED-01 — Prove the sensor (Device page)

01:42 · P2. Priya on a hotel network. Phone photo of a Windows Security shield. L1 already drafted “Defender missed the malware.” Timeline for her hostname is empty.

First tool: Assets → Devices at security.microsoft.com/machines. Search DEVICE-LAB-17.

If Sensor health state is Inactive / Misconfigured, or Last seen is days: quote that pair. Empty Timeline is expected. Next check is sensor — WinHTTP / proxy to service URLs, Sense, rename leftover, offboarding — not a new ASR Block.

If Active and Last seen is seconds: the sensor is talking. Now you are allowed to open Timeline and Alerts for that device and UTC window. A tray icon is not Last seen.

MDE-ED-02 — Prove why it did not block (ASR / next-gen protection)

02:05 · P2. winword.exe started powershell.exe. The process is still running. Someone typed “Defender failed” and wants every ASR rule set to Block for Finance so this never happens again tonight.

First tool: device Effective settings, then Reports → Endpoints → Attack surface reduction rules. Confirm Defender Antivirus mode on the Device health status card.

Proof field: rule Block all Office applications from creating child processes (GUID d4f940ab-401b-4efc-aadc-ad5f3c50688a) = Audit (code 2). ASR report Blocked/Audited? = Audited. Antivirus = Active — so the rule could have blocked if it were in Block. That is the ticket. MDE did what this host is configured to do. Isolate if Timeline shows live egress. Flip Audit → Block under change control on a ring. Do not call it a miss and do not save a tenant-wide policy at 02:10.

MDE-ED-03 — Prove the chain (Timeline)

02:20 · P1. ALR-1042. User still in Outlook. L1 wants to argue whether the file is named invoice.docm or Invoice (1).docm.

First tool: device page → Timeline (from the alert, the incident, or Assets → Devices). Select the 10:41Z ProcessCreated row → process tree.

Proof field: 10:41:02 winword.exe opened the document → 10:41:08 powershell.exe (MITRE T1059.001, Additional information: Suspicious script detected) → 10:41:12 rundll32.exe to 203.0.113.88. Last seen 22s, not isolated. Isolate first. Filename later. Hunt siblings with advanced hunting after the tree names the account.

MDE-ED-04 — Prove the case (Alert / Incident)

02:40 · P1. Queue shows Suspicious PowerShell, Severity High, Status New. Chat says “risk is High so it must already be isolated.”

First tool: Incidents & alerts → Alerts, then the device Overview cards.

Proof field: Severity = High, Status = New, Classification = not set. Device Risk level = High. Isolation = Not isolated. Microsoft’s risk field is for prioritisation (and optional Intune compliance). Isolate device is a separate response action. Assign the alert. Do not leave New while the laptop sits on the LAN.

MDE-ED-05 — Prove the click (Action center)

03:00 · P2. Someone already clicked Isolate device. The channel asks “are we contained?” A second person is about to click it again.

First tool: Action center → History, filtered to that device. Also re-read the device page isolation state.

Proof field: Isolate device · Success · submitting user · 10:52Z. If the row is Pending and Last seen is hours, you have a sensor ticket — Microsoft will retry isolate for up to three days, then stop. If Failed, quote the failure and fix reachability; do not click Isolate a third time. Release from isolation is the undo (comment + Confirm).

7. Traps + close-the-ticket proof

Proof · named field, then Closed

Sources

• Microsoft Learn — Explore devices in the device inventory (security.microsoft.com/machines; onboarding status, sensor health state, risk, exposure)
• Microsoft Learn — Check the device health / sensor health state (Active, Inactive, Misconfigured)
• Microsoft Learn — Fix unhealthy sensors (Inactive after seven days; rename leftover; impaired communications; no sensor data)
• Microsoft Learn — Investigate devices in Microsoft Defender for Endpoint (Last seen caveat; Timeline; Incidents and alerts; Effective settings; Device health status card)
• Microsoft Learn — Device entity page in Microsoft Defender (Overview cards; Timeline columns; Isolate device; Action center)
• Microsoft Learn — Investigate alerts in Microsoft Defender XDR (security.microsoft.com/alerts; Severity, Status)
• Microsoft Learn — Investigate incidents in the Microsoft Defender portal
• Microsoft Learn — Take response actions on a device (Isolate device; live response; collect investigation package; Action center; Active remediation actions; 7-day auto-lift)
• Microsoft Learn — Overview of the Action center (security.microsoft.com/action-center)
• Microsoft Learn — View and manage actions in the Action center (Pending / History; undo Isolate device)
• Microsoft Learn — ASR rules overview (modes Off / Block / Audit / Warn; Office-child GUID; AV must be Active)
• Microsoft Learn — Attack surface reduction in Microsoft Defender for Endpoint (Audit mode does not block)
• Microsoft Learn — ASR rules report (Blocked/Audited?; Reports → Endpoints → Attack surface reduction rules)
• Microsoft Learn — Configure ASR rules and exclusions (security.microsoft.com/policy-inventory)
• Microsoft Learn — Device health Microsoft Defender Antivirus health report (Last seen; Antivirus mode Active / Passive)
• Microsoft Learn — Investigate entities on devices using live response

Related: Blog 1 · Session factory — ASR audit vs block · Defender practice dashboard · Dummy lab · MDE interview Q&A