Forum Discussion

Iron Contributor

Sep 11, 2023

Solved

Live Response URL's

Hoping to clarify URL requirements for Live Response in Defender for Endpoint. The URLs listed in the Defender URLs spreadsheet online that reference being required for Live Response are: *.wns.w...

PJR_CDF
Sep 13, 2023
I've found an older version of the Defender URLs spreadsheet that has an entry for

*.notify.windows.com

The latest version of the spreadsheet doesnt contain this URL anymore and only lists the following requirements for Live Response:

*.wns.windows.com
login.live.com
login.microsoftonline.com

Interestingly in the ChangeLog tab on the latest version of the spreadsheet, it notes that *.notify.windows.com was removed on the 25/01/22. I have a version I downloaded in May this year with that URL present.

Regardless of the above it looks like perhaps they havent updated the connectivity analyzer to remove the test to global.notify.windows.com.

jbmartin6

Iron Contributor

Sep 11, 2023

Well, (client.wns.windows.com) is covered by *.wns.windows.com, maybe there is a wildcard elsewhere in the reference that covers (global.notify.windows.com)

jbmartin6
Iron Contributor
Sep 11, 2023
Ah sorry, I see you already considered that, my mistake I should have re-read before replying.
- PJR_CDF
  Iron Contributor
  Sep 13, 2023
  I've found an older version of the Defender URLs spreadsheet that has an entry for
  
  *.notify.windows.com
  
  The latest version of the spreadsheet doesnt contain this URL anymore and only lists the following requirements for Live Response:
  
  *.wns.windows.com
  login.live.com
  login.microsoftonline.com
  
  Interestingly in the ChangeLog tab on the latest version of the spreadsheet, it notes that *.notify.windows.com was removed on the 25/01/22. I have a version I downloaded in May this year with that URL present.
  
  Regardless of the above it looks like perhaps they havent updated the connectivity analyzer to remove the test to global.notify.windows.com.