Microsoft Defender for Office 365: Additional actions include submit, allow/block, and trigger AIR from Advanced Hunting.

Security Operations Center teams will gain new capabilities in Advanced Hunting to submit items for analysis, apply tenant-level block actions, and trigger automated investigation and response (AIR) directly from query results.