Trigger the Microsoft Defender for Endpoint from Configuration Item related list

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • Trigger a capability profile manually from the configuration item related list.

    Before you begin

    Role required: sn_si.admin or sn_si.analyst

    Procedure

    1. Navigate to Security Incidents > Show All Incidents.
    2. Select the security incident that you want to review with the Microsoft Defender for Endpoint information.
    3. Click Show All Related Lists.
    4. Click the Configuration Item related list.
    5. Select the added configuration items.
    6. From the Actions on selected rows, select a capability.
      The selected capability is triggered manually.
    7. Validate the work notes and activities section.
    8. View the tags, and validate the data in the related lists.