Blog Post

Microsoft Defender for Endpoint Blog
2 MIN READ

Introducing library management in Microsoft Defender

amibarayev's avatar
amibarayev
Icon for Microsoft rankMicrosoft
Feb 17, 2026
In dynamic investigation environments, preparation and agility are key. Security analysts working with live response in Microsoft Defender often rely on scripts and tools to triage, investigate, and ...
Updated Feb 17, 2026
Version 2.0
IronBrandedM's avatar
IronBrandedM
Copper Contributor
Feb 17, 2026

Good article. It would be interesting to have MDE Live Response sessions eventually support streaming or uploading the output of a script directly to a chosen destination, such as the host machine or Azure Blob Storage.

This capability would help ensure forensically sound artifact collection by minimizing changes to the investigated asset.