Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
5,771 questions
Investigation Package from Isolated Device
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 46%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPC%3C/text%3E%3C/svg%3E)
Panagiotis Chatzipanagiotou
0
Reputation points
Hello all,
I have successfully isolated a device and am currently attempting to run an AV Scan and collect an investigation package from it.
Both activities have been submitted and appear as Pending in the action center.
However, no matter how long I wait, they never start and never complete, resulting in them failing after a few days. At the same time, I have been able to collect an investigation package from another non-isolated device within the organization
I am mostly interested in the Investigation Package and i was wondering:
- Is there an issue when trying to collect an investigation package from an isolated device?
- If yes, are there any settings I could tamper with to make it happen?
Microsoft 365
{count} votes
-
Clive Watson 7,636 Reputation points MVP Moderator2023-03-02T16:56:34.2566667+00:00 Hello is this a Microsoft Sentinel issue, or an issue when you remediate an Incident from Sentinel in a portal such as Defender for Endpoint (or another EDR product)?
-
JamesTran-MSFT 36,871 Reputation points Microsoft Employee Moderator2023-03-06T21:45:08.5733333+00:00 I just wanted to check in and see if you had any other questions or if you were able to review Clive's comment?
-
Panagiotis Chatzipanagiotou 0 Reputation points
2023-03-10T13:40:00.2933333+00:00 Hello , for some reason I did not get notifications for these answers. Pardon me for the delay.
I am using Microsoft Defender for Endpoint
I have successfully Isolated a device using MDE
I am attempting to get an Investigation Package from the Isolated device and while the request is submitted it keeps failing after 3 days without being completed
Using the same account I was successful in getting an Investigation Package from another device in the same organization (this was to verify there was no Issue with user rights)
Again thanks for your time!
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(99.2, 72%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECW%3C/text%3E%3C/svg%3E)
Clive Watson 10 Reputation points2023-03-10T17:11:44.3933333+00:00 Hello, that's ok, this question would be better tagged for "Microsoft 365" rather than "Microsoft Sentinel"
Sign in to comment
Sign in to answer