Microsoft Defender for Endpoint: response actions, live response, antivirus troubleshooting and false positives
For security analysts and endpoint specialists who already know how Defender for Endpoint is onboarded and configured. Go deeper on what Microsoft documents about acting on a device and a file (isolation edge cases, investigation packages, stop and quarantine), running live response safely within its limits, troubleshooting Microsoft Defender Antivirus with event IDs, MpCmdRun and the performance analyzer, and working a false positive end to end without weakening protection. Concepts and vocabulary come from Microsoft Learn; menus move, so confirm in current documentation and follow your incident process.
- Level
- Advanced
- Length
- About 55 minutes
- Contents
- 3 lessons · 1 video · final exam
- Status
- Published · updated 2 Oct 2026
- Microsoft Defender for Endpoint
Skills you'll practise
- Choose the right device or file response action and predict its side effects, including isolation behind proxies, VPNs and on Hyper-V hosts
- Run a live response session within Microsoft's documented permissions and limits, and use the library for scripts
- Read Microsoft Defender Antivirus event IDs and MpCmdRun output to diagnose detections, update failures and disabled protection
- Use the performance analyzer and client analyzer to investigate scan performance and sensor health instead of guessing at exclusions
- Work a false positive through Microsoft's workflow: detection source, classification, remediation review, exclusions and submission
Course outline
- 1.Defender for Endpoint: response, live response, AV troubleshooting and false positivesVideo · 2 min
- 2.Acting on devices and filesLesson · 18 min
- 3.Live response within its limitsLesson · 17 min
- 4.Antivirus troubleshooting and false positivesLesson · 18 min
- 5.Microsoft Defender for Endpoint: response actions, live response, antivirus troubleshooting and false positives: knowledge checkKnowledge check · 17 questions
- 6.Final exam10 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- Microsoft Learn: Take response actions on a device
- Microsoft Learn: Take response actions on a file
- Microsoft Learn: Investigate entities on devices using live response
- Microsoft Learn: Address false positives and false negatives in Microsoft Defender for Endpoint
- Microsoft Learn: Configure and manage Microsoft Defender Antivirus with the MpCmdRun command-line tool
- Microsoft Learn: Microsoft Defender Antivirus event IDs and error codes
- Microsoft Learn: Performance analyzer for Microsoft Defender Antivirus
- Microsoft Learn: Troubleshoot Microsoft Defender for Endpoint onboarding issues
- Microsoft Learn: Microsoft Defender for Endpoint Client Analyzer overview
- Microsoft Learn: Overview of indicators in Microsoft Defender for Endpoint
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.