The "Run LiveResponses on Microsoft Defender for Endpoint" workflow template is designed to enhance Endpoint Detection and Response (EDR) capabilities by automating Live Response actions on Microsoft Defender for Endpoint. This workflow allows security teams to execute commands such as retrieving or placing files, running scripts, or executing a set of commands on endpoints. It collects and stores the results of these actions, providing a comprehensive view of endpoint activities and facilitating efficient incident response.
Optional Triggers
["This workflow is intended to be used as a function."]
Use Cases
Endpoint Detection and Response (EDR) , Function
Workflow Breakdown
Workflow takes as an input machineId or computerDnsName values.
Run a single command such as Get a File, Put a File and Run a script or a complete set of commands with all three mentioned actions.
Workflow will wait a specified period of time to verify the action is successfully applied.
Collect results of each response as a tqfile.
Collects a list of LiveResponse previous actions.
Vendors
Utils, Microsoft Defender for Endpoint
Workflow Output
Summary includes the executed command along with its results as a file