You manage 100 Azure VMs onboarded to Microsoft Defender for Cloud. If Defender for Cloud raises the "Antimalware disabled in the virtual machine" alert, you want the affected VM to be shut down automatically. Which Defender for Cloud capability should you use?

A logic app is the correct choice because it allows you to automate workflows and respond to events, such as Defender for Cloud alerts. You can configure a logic app to trigger when a specific alert (like "Antimalware disabled") is raised and then execute an action, such as shutting down the affected VM. Workbooks are for data visualization and reporting, not automation. Security policies define security configurations and compliance requirements, but they don't directly automate responses to alerts. Adaptive network hardening recommends network security group rules based on actual traffic patterns and is not designed for automated VM shutdown in response to antimalware alerts.