Event details
6 Comments
Thanks for the wonderfull session. Learning day by day using this Ninja show. Can we able to collect the Event viewer logs using Live response session? In some scenarios we may get communication errors, sensor errors etc... So If we collect the event viewer logs of endpoint using live response session we can able to identify what is the exact issue using event ID. I hope this will be helpful for security experts to fix the issues without interacting with end users.
This is a great video and a quick look at the Live Response function. I have a question regarding the execution of scripts using the "run" command, is there any limitation on the actions that can be executed from the script that has been loaded into the library?
Ameer_TabonyMicrosoft
In case of params are required, they need to be primitive types. In addition, the script size limit to be uploaded to the library is 10mb. And lastley, scripts execution time limit is 30 minutes (longer than 30m will be timed out).
For live response are there preset (top 5) command lines available besides typing Help which we can run on machines to take actions. For example, when machines not managed by Intune and onboarded in MDE and are reported "Waiting for restart" after an update .....how can a restart be initiated with Live Response?
- Ameer_TabonyAll live response commands are listed within Help action. Regarding the example of "Waiting for restart", you can create ps to reboot the device and execute it either from live response console or with live response API.
- Welcome to this episode of the "Microsoft 365 Defender Virtual Ninja Training" show with Heike Ritter. The team is here to answer your questions about Microsoft 365 Defender and Live Response. Please post each in a separate thread, and don't be shy!
