MDE Live Response скачать в хорошем качестве

MDE Live Response

MDE - Live Response: Real-time investigation and dependency of IT admins/end-user/app owner are some challenges that secops team experience during the investigation of any ongoing security incident in an environment. With help of MDE Live response, target endpoint investigation can be performed in real-time by removing the dependency of IT admins or end-user. Microsoft Defender offers Live Response capability which can be used to do cloud-based remote shell connection of target endpoint and perform the real time investigation and remediation on target systems. Some important factors about Live Response: -Enable live response features in Defender portal -Supported in Windows, Linux and macOS environment -Live response library stores files (such as scripts) that can be run in a live response session at the tenant level. -25 live response sessions at a time. -Live response session inactive timeout value is 30 minutes. -Individual live response commands have a time limit of 10 minutes, with the exception of getfile, findfile, and run, which have a limit of 30 minutes. -A user can initiate up to 10 concurrent sessions. -A device can only be in one session at a time. -The following file size limits apply: 1. getfile limit: 3 GB 2. fileinfo limit: 30 GB 3. library limit: 250 MB #liveresponse #mde #dfe #defenderforendpoint #microsoftsecurity #secops #m365defender #endpointsecurity #windows11