The "QuickAction - Run a command on a device with MS Defender Endpoint" workflow template is designed for SOC analysts to efficiently execute diagnostic commands on remote endpoints using Microsoft Defender for Endpoint. This workflow automates the execution of commands like ping, netstat, tracert, and ipconfig, waiting for the target device to come online before initiating a session. The results are automatically documented as case notes, streamlining threat hunting and case management processes.
Use Cases
Case Management , Threat Hunting
Workflow Breakdown
The analyst can select from a pre-defined set of commands, such as ping, tracert, netstat, and ipconfig.
LiveResponse waits for the target endpoint to come online, then automatically initiates a session to execute the chosen commands.
Add each command output as a note for the analyst to review.
Vendors
Scripting, Utils, HTTP, Microsoft Defender for Endpoint, Torq Cases
Workflow Output
Commands output are added as a case note.