Forum Discussion
Audit/Alerting on the use of Live Response
Wondering if/how people are auditing/monitoring the use of Live Response in their environments? From what I've seen so far, all actions are logged in the Action Center which is great but ideally ...
Maybe the local Windows log Applications/Microsoft/Windows/SenseIR can help. It logs when SenseIR is executed, as well as the powershell script runner. Not much detail beyond that but at least you can see when IR actions are run.