Microsoft Defender ATP - Run Live Command

Microsoft Defender ATP - Run Live Command runs a sequence of live response commands on devices returned by the selected query or devices selected on the relevant asset page.

• Assets returned by the selected query or assets selected on the relevant asset page.

See Creating Enforcement Sets to learn more about adding Enforcement Actions to Enforcement Sets.

When accessing an enforcement action using the API, you must use the backend form of field names.

Use the Syntax Helper to find the correct name. In the enforcement action, enable Configure Dynamic Values and select Syntax Helper.

📘

Note

• Not all asset types are supported for all Enforcement Actions.
• See Actions supported for Activity Logs, Adapters Fetch History, and Asset Investigation modules.
• See Actions supported for Aggregated Security Findings.
• See Actions supported for Software.

Required Fields

These fields must be configured to run the Enforcement Action.

• Use stored credentials from the Defender ATP adapter - Select this option to use credentials from the adapter connection. By default, the first connection is selected.

  • When you select this option, the Select Adapter Connection drop-down becomes available. Select the adapter connection to use for this Enforcement Action.

  📘

  Note

  To use this option, you must successfully configure a Microsoft Defender for Endpoint adapter connection.

• Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.

Additional Fields

These fields are optional.

• Comment - Enter a comment to associate with the live response action.
• PutFile - Expand to configure a file upload command.
  • File Name - Enter the name of the file from the live response library to put on the device. The file is saved in a working folder and deleted when the device restarts.
• RunScript - Expand to configure a script execution command.
  • Script Name - Enter the name of the script from the live response library to run on the device.
  • Args - Enter any arguments to pass to the script. Times out after 10 minutes.
• GetFile - Expand to configure a file collection command.
  • Path - Enter the full path of the file to collect from the device. Escape any backslashes in the path.

APIs

Axonius uses the Run live response commands API - POST /api/machines/{machine_id}/runliveresponse

Required Ports

Axonius must be able to communicate via the following ports:

• TCP port 443

Required Permissions

The Microsoft Entra ID (Azure AD) application configured in the Defender ATP adapter must have the following Application permission:

• Machine.LiveResponse

See the Microsoft Defender for Endpoint documentation for more information.