Stop And Quarantine File - BlinkOps Documentation

Stop execution of a file on a device and delete it. The following permissions are required to run this action:

Machine.StopAndQuarantine
Machine.ReadWrite.All

External DocumentationTo learn more, visit the Microsoft Defender for Endpoint documentation.

Parameters

Parameter	Description
Comment	The comment to associate with the action.
Machine ID	The ID of the machine. Can be obtained using the `List Machines` action.
Sha1	The `sha1` of the file to stop and quarantine on the device.

Example Output

{
	"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineActions/$entity",
	"id": "5382f7ea-7557-4ab7-9782-d50480024a4e",
	"type": "StopAndQuarantineFile",
	"title": null,
	"requestor": "Blink Ops Lab App",
	"requestorComment": "Stop and quarantine file on machine due to alert",
	"status": "Pending",
	"machineId": null,
	"computerDnsName": null,
	"creationDateTimeUtc": "2026-07-14T13:28:22.9480733Z",
	"lastUpdateDateTimeUtc": "2026-07-14T13:28:22.9480767Z",
	"cancellationRequestor": null,
	"cancellationComment": null,
	"cancellationDateTimeUtc": null,
	"errorHResult": 0,
	"scope": null,
	"externalId": null,
	"requestSource": "PublicApi",
	"relatedFileInfo": null,
	"commands": [],
	"troubleshootInfo": null
}

Workflow Library Example

Stop and Quarantine File with Microsoft Defender for Endpoint and Send Results Via Email

Preview this Workflow on desktop