windows-itpro-docs/windows/security/threat-protection/microsoft-defender-atp/response-actions.md

title, description, keywords, search.product, search.appverid, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.author, author, ms.localizationpriority, manager, audience, ms.collection, ms.topic

title	description	keywords	search.product	search.appverid	ms.prod	ms.mktglfcycl	ms.sitesec	ms.pagetype	ms.author	author	ms.localizationpriority	manager	audience	ms.collection	ms.topic
Take response actions on files and machines in Microsoft Defender ATP	Take response actions on files and machines by stopping and quarantining files, blocking a file, isolating machines, or collecting an investigation package.	respond, stop and quarantine, block file, deep analysis, isolate machine, collect investigation package, action center	eADQiWindows 10XVcnh	met150	w10	deploy	library	security	macapara	mjcaparas	medium	dansimp	ITPro	M365-security-compliance	article

Take response actions in Microsoft Defender ATP

Applies to:

• Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)

Want to experience Microsoft Defender ATP? Sign up for a free trial.

You can take response actions on machines and files to quickly respond to detected attacks so that you can contain or reduce and prevent further damage caused by malicious attackers in your organization.

Note

The machine related response actions are only available for machines on Windows 10 (version 1703 or higher), Windows Server, version 1803 and Windows Server 2019.

In this section

Topic	Description
Take response actions on a machine	Isolate machines or collect an investigation package.
Take response actions on a file	Stop and quarantine files or block a file from your network.