User permissions are controlled by RBAC custom roles. For more information, see Live response commands.Īfter completing your investigation, select Disconnect session, then select Confirm.ĭepending on the role that's been granted to you, you can run basic or advanced live response commands. Use the built-in commands to do investigative work. Wait while the session connects to the device. Launch the live response session by selecting Initiate live response session. Navigate to Endpoints > Device inventory and select a device to investigate. Sign in to Microsoft 365 Defender portal. Initiate a live response session on a device The dashboard provides information about the session such as the following: When you initiate a live response session on a device, a dashboard opens. Users permissions are controlled by RBAC custom role. The button is greyed out for users with only delegated permissions.ĭepending on the role that's been granted to you, you can run basic or advanced live response commands. The option to upload a file to the library is only available to users with with 'Manage Security Settings' permission. You'll need to enable the live response capability in the Advanced features settings page. Linux - Minimum required version: 101.45.13Įnable live response from the advanced settings page. Supported for Intel-based and ARM-based macOS devices. MacOS - Minimum required version: 101.43.84. Verify that you're running a supported version of Windows.ĭevices must be running one of the following versions of Windows

Upload a PowerShell script or executable to the library and run it on a device from a tenant level.īefore you can initiate a session on a device, make sure you fulfill the following requirements:.

Download files in the background (new!).

Download files such as malware samples and outcomes of PowerShell scripts.Run basic and advanced commands to do investigative work on a device.With live response, analysts can do all of the following tasks:

Download NetStat Live