---
updatedAt: 2026-08-26T08:15:14.000Z
agentTools:
  projectIndex: https://docs.axonius.com/llms.txt
---

# Microsoft Defender ATP - Run Live Command

**Microsoft Defender ATP - Run Live Command** runs a sequence of live response commands on devices returned by the selected query or devices selected on the relevant asset page.

* Assets returned by the selected query or assets selected on the relevant asset page.

See [Creating Enforcement Sets](/docs/create-ec-set) to learn more about adding Enforcement Actions to Enforcement Sets.

<Accordion title="When accessing an enforcement action using the API, you must use the backend form of field names. " icon="fa-info-circle">
  Use the [Syntax Helper](/docs/using-the-syntax-helper) to find the correct name. In the enforcement action, enable **Configure Dynamic Values** and select **Syntax Helper**.


  <Image src="https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/img/action_center/SyntaxHelperForAPIECs.png" width="550px" />

</Accordion>

<Callout icon="📘" theme="info">
  ### Note

  - Not all asset types are supported for all Enforcement Actions.
  - See Actions supported for [Activity Logs, Adapters Fetch History, and Asset Investigation modules](/docs/creating-queries-filters#using-activity-log-adapter-fetch-history-asset-investigation-and-findings-queries-in-enforcement-actions).
  - See Actions supported for [Aggregated Security Findings](https://docs.axonius.com/docs/vulnerabilities#using-aggregated-security-findings-queries-in-enforcement-actions).
  - See Actions supported for [Software](software#using-software-queries-in-enforcement-actions).
</Callout>

## Required Fields

These fields must be configured to run the Enforcement Action.

* **Action name** - The name of this Enforcement Action. The system sets a default name. You can change the name.
* **Configure Dynamic Values** *(optional)* - Toggle on to enter a Dynamic Value statement. See [Creating Enforcement Action Dynamic Value Statements](https://docs.axonius.com/docs/config-ec-conditions) to learn more about Dynamic Value statement syntax.

- **Use stored credentials from the Defender ATP adapter** - Select this option to use credentials from the adapter connection. By default, the first connection is selected.

  * When you select this option, the **Select Adapter Connection** drop-down becomes available. Select the adapter connection to use for this Enforcement Action.

  <Callout icon="📘" theme="info">
    Note

    To use this option, you must successfully configure a [Microsoft Defender for Endpoint](/docs/microsoft-defender-atp) adapter connection.
  </Callout>

- **Compute Node**  - The Axonius node to use when connecting to the specified host. For more details, see [Working with Axonius Compute Nodes](https://docs.axonius.com/docs/connecting-additional-axonius-nodes).

## Additional Fields

These fields are optional.

* **Comment** - Enter a comment to associate with the live response action.
* **PutFile** - Expand to configure a file upload command.
  * **File Name** - Enter the name of the file from the live response library to put on the device. The file is saved in a working folder and deleted when the device restarts.
* **RunScript** - Expand to configure a script execution command.
  * **Script Name** - Enter the name of the script from the live response library to run on the device.
  * **Args** - Enter any arguments to pass to the script. Times out after 10 minutes.
* **GetFile** - Expand to configure a file collection command.
  * **Path** - Enter the full path of the file to collect from the device. Escape any backslashes in the path.

## APIs

Axonius uses the [Run live response commands API](https://learn.microsoft.com/en-us/defender-endpoint/api/run-live-response) - POST `/api/machines/{machine_id}/runliveresponse`

## Required Ports

Axonius must be able to communicate via the following ports:

* TCP port 443

## Required Permissions

The Microsoft Entra ID (Azure AD) application configured in the [Defender ATP adapter](/docs/microsoft-defender-atp) must have the following Application permission:

* Machine.LiveResponse

See the [Microsoft Defender for Endpoint documentation](https://learn.microsoft.com/en-us/defender-endpoint/api/run-live-response#permissions) for more information.

***

For more details about other enforcement actions available, see [Action Library](/docs/action-library).