Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Investigate entities on devices using live response

4 September 2026Feature update+26 / −25 lines

In brief

Background file downloads now use `getfile`; the US Government `library` limit is documented as 5 MB by default, with higher limits available through support. Command guidance and links were also clarified.

What Defender admins need to know

Update operational guidance and account for the 5 MB library limit when using live response in US Government environments.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Investigate entities on devices using live response

Download a file in the background

To enable your security operations team to continue investigating an impacted device, files can now be downloaded in the background.

  • To download a file in the background, in the live response command console, type downloadgetfile <file_path> &.
  • If you are waiting for a file to be downloaded, you can move it to the background by using Ctrl + Z.
  • To bring a file download to the foreground, in the live response command console, type fg <command_id>.

Live response has a library where you can put files into. The library stores files (such as scripts) that can be run in a live response session at the tenant level.

Live response allows PowerShell and Bash scripts to run; however, you must first putupload the script files intoto the library before you can run them.the scripts.

You can havemaintain a collection of PowerShell and Bash scripts that you can run on devices that you initiateduring live response sessions with.sessions.

To upload a file in the library

Cancel a command

Anytime during a session, you can cancel a command by pressing CTRL + C.

To cancel a command in the portal during a session, press CTRL + C.

Run a script

You can upload a script to the library from the live response session console or from the Library management page.

After uploading the script to the library, use the run command to run the script.

If you plan to use an unsigned PowerShell script in the session, you'll need to enable the setting in the Advanced features settings page.

After uploading the script to the library, use the run command to run the script.

Apply command parameters

Use the following approaches to view and apply command parameters.

  • To view syntax and available parameters for a specific command, use the built-in help command: 

    help <command name>

  • When applying parameters to commands, note that parameters are handled based on a fixed order. The following example shows the basic syntax for invoking a command with positional parameters: 

    <command name> param1 param2

  • When specifying parameters outside of the fixed order, specify the name of the parameter with a hyphen before providing the value. The following example shows named parameter usage: 

    <command name> -param2_name param2

  • When using commands that have prerequisite commands, you can use flags. The following example shows how to target a file by path and run the prerequisite command automatically: 

    <command name> -type file -id <file path> -auto

    Or, to automatically remediate a detected file, run: 

    remediate file <file path> -auto

Supported output types

Live response supports output piping to CLI and file. CLI is the default output behavior. You can pipe the output to a file using the following command: [command] > [filename].txt.

For example, to save the process list to a text file instead of displaying it on screen, redirect the output as shown here:

processes > output.txt