Live Response - notification via email

%3CLINGO-SUB%20id%3D%22lingo-sub-3282084%22%20slang%3D%22en-US%22%3ELive%20Response%20-%20notification%20via%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3282084%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eis%20it%20possible%20to%20receive%20an%20email%20when%20Live%20Response%20console%20is%20used%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3EJan%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3290508%22%20slang%3D%22en-US%22%3ERe%3A%20Live%20Response%20-%20notification%20via%20email%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3290508%22%20slang%3D%22en-US%22%3EHello%2C%20No%20an%20email%20is%20not%20generated%2C%20however%20you%20can%20view%20the%20Command%20log%20(%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Flive-response%3Fview%3Do365-worldwide%23view-the-command-log%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Flive-response%3Fview%3Do365-worldwide%23view-the-command-log%3C%2FA%3E)%20or%20check%20Activity%20details%20in%20the%20Action%20Center%20(%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Frespond-machine-alerts%3Fview%3Do365-worldwide%23check-activity-details-in-action-center%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Frespond-machine-alerts%3Fview%3Do365-worldwide%23check-activity-details-in-action-center%3C%2FA%3E).%20%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3EYou%20can%20also%20use%20the%20List%20MachineActions%20API%20which%20includes%20the%20LiveResponse%20MachineActions%20to%20automate%20receiving%20notifications%20for%20these%20actions%20-%20%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Fget-machineactions-collection%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Fget-machineactions-collection%3Fview%3Do365-worldwide%3C%2FA%3E%3CBR%20%2F%3EMachineAction%20resource%20type%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Fmachineaction%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fdefender-endpoint%2Fmachineaction%3Fview%3Do365-worldwide%3C%2FA%3E%20Thanks.%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi,

 

is it possible to receive an email when Live Response console is used?

 

Regards,

Jan

1 Reply
Hello, No an email is not generated, however you can view the Command log (https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/live-response?view=o365-wo...) or check Activity details in the Action Center (https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine-alerts?vie...).


You can also use the List MachineActions API which includes the LiveResponse MachineActions to automate receiving notifications for these actions -
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-machineactions-collect...
MachineAction resource type
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/machineaction?view=o365-wo... Thanks.