Viewing records of ATR actions for Microsoft Defender for Endpoint

Every action carried out by ATR is detailed in the alert body and logged in the Audit Log in the Barracuda XDR Dashboard.

For automated actions, the user is listed as xdr.automation.

For manual actions, the source user is listed.

The potential actions are:

• Microsoft Defender for Endpoint Start Isolate Device

• Microsoft Defender for Endpoint Start Unisolate Device

• Endpoint Device Isolation Result

1. In XDR Dashboard, click ATR Settings > Endpoint.

2. Click View Audit History.

This takes you to the Administration > Audit Log page. Filtering is applied to show you only ATR actions.