Inspect the endpoint’s live state

The Defender Live Response scripts collect security logs, run commands and examine network connections or listening services. On-demand retrieval of Defender status and configuration complements centrally available EDR telemetry with the current state reported by the device.