Lesson 14 — Live Response Basics
Live Response gives authorised security analysts a secure remote shell for investigating a live endpoint through Microsoft Defender for Endpoint.
It can be used to inspect processes, services, files, connections and persistence, collect evidence and run approved response scripts without relying on Remote Desktop.
This lesson explains when Live Response should be used, how to work safely, which commands support investigation and why evidence should be collected before changes are made.
What you will learn
This lesson explains how to use Live Response safely during endpoint investigations.
Learning objectives
After completing this lesson, you should be able to use Live Response safely as part of a structured endpoint investigation.
- Explain what Live Response is.
- Identify appropriate and inappropriate use cases.
- Start and navigate a Live Response session.
- Use common investigation and evidence-collection commands.
- Apply operational safety and documentation practices.
The problem this solves
Telemetry may show that something suspicious happened without providing every artefact required for deeper analysis.
Live Response allows an authorised analyst to inspect the endpoint directly and collect evidence without using conventional remote administration.
What is Live Response?
Live Response is a secure remote investigation shell built into Microsoft Defender for Endpoint.
It allows authorised security personnel to connect to a managed device, inspect its current state, retrieve evidence and perform controlled response actions.
Use telemetry and Advanced Hunting first. Use Live Response when you need direct evidence or validation from the endpoint.
Where Live Response fits
Why Live Response matters
Some investigations require direct access to files, services, processes or local persistence.
Live Response bridges the gap between central telemetry and endpoint forensics.
When to use it
Use Live Response when the investigation requires evidence or validation not available through the portal alone.
Typical cases include malware, ransomware, suspicious PowerShell, persistence, credential theft and lateral movement.
When not to use it
Live Response should not replace normal IT administration or support tools.
Avoid using it for routine software deployment, user troubleshooting or general device maintenance.
Authorisation
Live Response access should be limited through role-based access control.
Only trained and authorised analysts should be able to start sessions and run remediation commands.
Device prerequisites
The endpoint must be onboarded, supported and able to communicate with Defender for Endpoint.
Check sensor health and device status before relying on the session.
Starting a session
Open the device page and select the Live Response action.
The portal establishes a remote shell and records the session for auditing.
Starting workflow
Session interface
The Live Response interface provides a command prompt, session history and access to supported investigation commands.
It may also provide access to approved scripts and files stored in the response library.
Audit trail
Commands and session activity should be auditable.
This supports accountability, review and incident documentation.
help
The help command displays available commands and syntax.
Use it before running unfamiliar actions rather than guessing.
pwd
The pwd command shows the current working directory.
This helps confirm where the session is operating before file actions are performed.
cd
The cd command changes the current directory.
Navigate carefully and record the path of any collected evidence.
dir
The dir command lists files and folders.
Use it to inspect suspicious locations, persistence paths and staging directories.
processes
The processes command lists running processes.
Compare the live process state with DeviceProcessEvents and the Device Timeline.
services
The services command lists Windows services.
Review unexpected service names, binary paths and service states.
connections
The connections command displays current network connections.
Use it to validate active communication identified in DeviceNetworkEvents.
registry
Registry commands can help inspect suspicious keys and values.
Use them to validate persistence or configuration changes found in DeviceRegistryEvents.
Common investigation commands
| Command | Purpose |
|---|---|
| help | Displays supported commands and syntax. |
| pwd / cd / dir | Navigates and inspects the file system. |
| processes | Shows running processes. |
| services | Shows installed and running services. |
| connections | Shows current network connections. |
| getfile | Collects a file for investigation. |
getfile
The getfile command retrieves a file from the endpoint for analysis.
Record the original path, reason for collection and related investigation evidence.
Evidence collection
Collect only files that are relevant to the hypothesis.
Large or unfocused collection can waste time and complicate evidence handling.
File integrity
Where possible, record hashes and metadata for collected artefacts.
This supports integrity validation and later analysis.
Response library
The Live Response library can store approved scripts and tools.
Centralised content supports repeatability and reduces uncontrolled analyst behaviour.
Running scripts
Approved scripts can collect evidence or perform controlled remediation.
Review the script purpose, expected output and possible impact before execution.
Script standardisation
Standard scripts reduce typing errors and ensure analysts follow the same collection process.
They should be reviewed, versioned and documented.
Unsigned or unapproved tools
Do not upload or execute unreviewed tools during an incident.
They may alter evidence, introduce risk or violate organisational policy.
Collect before changing
Capture relevant evidence before killing processes, deleting files or modifying persistence.
Response actions can destroy the artefacts needed to explain the incident.
Evidence-first workflow
Operational safety
Live Response commands can alter the endpoint and disrupt operations.
Understand the effect of every command before running it.
Do not reboot casually
A reboot can destroy volatile evidence, terminate sessions and change process state.
Reboot only when the response plan specifically requires it.
Do not kill random processes
Terminating a process can remove evidence or disrupt critical services.
Confirm the process identity, impact and containment objective first.
Do not delete evidence
Deleting a suspicious file may feel like remediation but can damage the investigation.
Collect and document the artefact before removal.
Do not change timestamps
Opening, copying or modifying files can alter metadata.
Use approved collection methods and document any unavoidable changes.
Business impact
A device may support production, healthcare, finance or critical operations.
Coordinate with the incident owner before disruptive actions.
Session concurrency
Avoid multiple analysts making conflicting changes on the same endpoint.
Assign ownership and communicate the session objective.
Chain of custody
Evidence handling should preserve integrity, source, timing and analyst actions.
Document who collected the file, from where, when and why.
Investigation notes
Record commands, outputs, files collected and changes made.
Good notes support handover, reporting and later review.
Close the session
End the session when the investigation objective is complete.
Confirm that evidence has been saved and actions documented.
Live Response investigation workflow
Common mistake
A common mistake is opening Live Response before reviewing telemetry.
Without a hypothesis, the session becomes unfocused and increases the risk of unnecessary changes.
Another common mistake
Do not perform remediation before evidence collection.
The process, file or persistence mechanism may be the only proof of what occurred.
Agent Foskett investigation tip
Use Live Response to validate a hypothesis and preserve the endpoint story before containment or remediation alters it.
Best practices
- Review telemetry before connecting.
- Define a clear session objective.
- Collect evidence before remediation.
- Use approved scripts and tools.
- Document every command and action.
- Consider business impact before disruption.
Agent Foskett takeaway
Live Response bridges the gap between central telemetry and direct endpoint investigation.
Used carefully, it allows analysts to validate hypotheses, collect evidence and perform controlled response without losing the structure and integrity of the investigation.
Related Agent Foskett learning
Continue learning
Microsoft Defender for Endpoint Live Response
Live Response provides authorised analysts with a secure remote shell for endpoint investigation, evidence collection, process and service inspection, file retrieval and controlled remediation.
Module 3 Endpoint Investigations — Live Response Lesson 14
This Agent Foskett Defender for Endpoint Academy lesson explains Live Response permissions, commands, approved scripts, operational safety, documentation and evidence-handling practices.
