Skip to content

Commit

Permalink
Update live response documentation with links and formatting
Browse files Browse the repository at this point in the history
  • Loading branch information
denisebmsft authored Dec 30, 2024
1 parent f9a57ed commit 34d929f
Showing 1 changed file with 10 additions and 8 deletions.
18 changes: 10 additions & 8 deletions defender-endpoint/live-response.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ ms.collection:
ms.topic: conceptual
ms.subservice: edr
search.appverid: met150
ms.date: 04/03/2024
ms.date: 12/30/2024
---

# Investigate entities on devices using live response
Expand Down Expand Up @@ -124,9 +124,9 @@ The dashboard also gives you access to:
> [!NOTE]
> Live response actions initiated from the Device page are not available in the machineactions API.
1. Sign in to Microsoft Defender portal.
1. Sign in to [Microsoft Defender portal](https://security.microsoft.com).

2. Navigate to **Endpoints > Device inventory** and select a device to investigate. The devices page opens.
2. Navigate to **Endpoints** > **Device inventory** and select a device to investigate. The devices page opens.

3. Launch the live response session by selecting **Initiate live response session**. A command console is displayed. Wait while the session connects to the device.

Expand Down Expand Up @@ -234,19 +234,21 @@ Live response allows PowerShell scripts to run, however you must first put the f
You can have a collection of PowerShell scripts that can run on devices that you initiate live response sessions with.

#### To upload a file in the library
Note: There are restrictions on the characters that can be uploaded to the library. Please use alphanumeric characters and some symbols(-, _, .).

1. Click **Upload file to library**.
> [!NOTE]
> There are restrictions on the characters that can be uploaded to the library. Use alphanumeric characters and some symbols(`-`, `_`, or `.`).
1. Select **Upload file to library**.

2. Click **Browse** and select the file.
2. Select **Browse** and select the file.

3. Provide a brief description.

4. Specify if you'd like to overwrite a file with the same name.

5. If you'd like to be, know what parameters are needed for the script, select the script parameters check box. In the text field, enter an example and a description.

6. Click **Confirm**.
6. Select **Confirm**.

7. (Optional) To verify that the file was uploaded to the library, run the `library` command.

Expand All @@ -255,7 +257,7 @@ Note: There are restrictions on the characters that can be uploaded to the libra
Anytime during a session, you can cancel a command by pressing CTRL + C.

> [!WARNING]
> Using this shortcut will not stop the command in the agent side. It will only cancel the command in the portal. So, changing operations such as "remediate" may continue, while the command is canceled.
> Using this shortcut will not stop the command in the agent side. It only cancels the command in the portal. So, changing operations such as "remediate" may continue, while the command is canceled.
## Run a script

Expand Down

0 comments on commit 34d929f

Please sign in to comment.