Skip to content
Back to the Handbook
Free direct downloadMicrosoft 365SecurityResilience

Incident Response Pack for Microsoft Defender

Operational templates for triage, device isolation, email purge, identity compromise and detection review.

Download the ZIPSee the files

No account and no email needed. An optional email copy is below.

How to use it

How to use this pack

What to do, and who may do it, when Microsoft Defender raises an incident. It covers triage, containment, email response, identity compromise, detection tuning and monthly operational review.

  1. Check your tenant against defender-deployment-baseline.md.
  2. Agree who may run each of the four runbooks before an incident happens.
  3. Log every tuning change in detection-tuning-ledger.md and review it monthly.

Before you rely on it

Response authority, licensing and portal capabilities must be confirmed before an incident.

Want a copy in your inbox?

Optional email delivery makes the link easy to recover. You can download above without submitting anything.

Used only to fulfil this request. Read the privacy notice.

Published by Michal Jatczak, trading as ITSailor.SHA-256 for this pack