This workflow template enables SOC analysts to execute predefined commands like ping, tracert, netstat, and ipconfig on remote endpoints using Microsoft Defender for Endpoint. It automates the process of waiting for the target endpoint to come online, executing the commands, and logging the outputs as case notes for review. Ideal for threat hunting and case management, it enhances response times and accuracy in handling incidents.
Use Cases
Case Management , Threat Hunting
Workflow Breakdown
The analyst can select from a pre-defined set of commands, such as ping, tracert, netstat, and ipconfig.
LiveResponse waits for the target endpoint to come online, then automatically initiates a session to execute the chosen commands.
Add each command output as a note for the analyst to review.
Vendors
Scripting, Utils, HTTP, Microsoft Defender for Endpoint, Torq Cases
Workflow Output
Commands output are added as a case note.