Apologies for the lack of formatting. I promise i used spaces and paragraphs but the text boxes here didn't appreciate that effort. Thanks for taking the time to read through my submissions below. One final point would be possible feature requests: Better logging of Live Response activations and channel destruction in M365 Defender. I see there is "connect" logging now but no destruction logging yet. On the Windows Event Logging on the host, both AIR and Live Response use the same commands when launching the SenseIR.exe with arguments "OnlineSenseIR"(opposed to Threat Hunting using "OfflineSenseIR"). Could AIR and LR be split out so that we can alert on the process argument to detect each individually? This includes SenseIR.exe "OnlineSenseIR" being abused by Device Discovery. Thanks again everyone!