3.4.2. Device Response Actions and Live Response
💡 First Principle: Containment trades disruption against risk. Each response action removes a specific capability from the attacker (network reach, the ability to run unsigned code, a particular file) at a specific cost to the user. Choosing well means removing what the attacker needs while preserving what the investigation and the business need.
| Action | What it does | When to choose it |
|---|---|---|
| Isolate device (full) | Blocks network traffic except the Defender for Endpoint connection; released from the device page or Action center | Active attacker or ransomware on the device |
| Isolate device (selective) | Full isolation but allows Outlook and Teams | User must stay reachable during investigation |
| Contain device | Other onboarded devices block communication with an unmanaged or compromised device | Stop lateral movement from a device you can't isolate (for example, unmanaged) |
| Restrict app execution | Code integrity policy lets only Microsoft-signed binaries run | Stop attacker tools while keeping the device online for investigation |
| Run antivirus scan | Quick or full Defender Antivirus scan | Check for known malware after initial findings |
| Collect investigation package | Downloads a forensic zip of the device's current state | Preserve evidence before remediation or reimaging |
| Initiate automated investigation | Starts AIR on the device | Let automation examine and remediate |
| Initiate live response session | Remote shell for forensics and remediation | Hands-on investigation |
| Stop and quarantine file | Kills processes and quarantines the file on all devices where seen | Known-bad file |
The investigation package for Windows contains autoruns, installed programs, network connections (including ARP and DNS cache), prefetch files, processes, scheduled tasks, the Security event log, services, SMB sessions, system information, temp directories, users and groups, and Defender support logs. Collect it before remediation, because remediation and reimaging destroy evidence. Most actions beyond scanning, isolation, and file quarantine require Defender for Endpoint Plan 2, and actions require an RBAC role with active remediation permissions. Every action is tracked in the Action center, where many can be undone (release from isolation, remove app restrictions).
Live response opens a remote shell on the device. It must be enabled in Advanced features (separately for servers). Basic commands, available to roles with basic live response permission, include processes, services, connections, registry, persistence, scheduledtasks, findfile, fileinfo, and getfile (download a file, up to 3 GB). Advanced commands include run (execute a script from the library), putfile (copy a library file to the device), remediate (remove a file, process, service, registry entry, scheduled task, or startup item), undo (Windows), analyze (submit an entity for a verdict), plus collect, isolate, release, scan, and library. Scripts must be uploaded to the library first, and unsigned PowerShell scripts run only if Enable live response unsigned script execution is turned on. Limits worth recognizing: one session per device, five concurrent sessions per user, 50 per tenant, and a 30-minute inactivity timeout. The command log records every command in the session.
⚠️ Exam Trap: "Run a custom PowerShell collection script on a device during an investigation" requires uploading the script to the live response library, an analyst role with advanced live response permissions, and, if the script is unsigned, the unsigned script execution advanced feature. Any one missing produces the failure the question describes.
Reflection Question: A ransomware alert fires on a server that hosts a critical database. Which actions would you take in which order, and why might restrict app execution or selective isolation fit better than full isolation for this server?
