Skip to main content

Connect-XdrEndpointDeviceLiveResponse

SYNOPSIS​

Opens a Live Response session to an endpoint device in Microsoft Defender XDR.

SYNTAX​

Connect-XdrEndpointDeviceLiveResponse [-DeviceId] <String> [[-DeviceName] <String>] [[-LastSeen] <Object>]
 [[-OsPlatform] <String>] [-NonInteractive] [-NoStatusTable] [-ProgressAction <ActionPreference>]
 [<CommonParameters>]

DESCRIPTION​

Creates a Live Response session to the specified device. By default, the cmdlet provides an interactive command-line interface where you can type Live Response commands and see results.

When -NonInteractive is specified, the cmdlet establishes the session, loads command definitions, and returns a session object without entering the prompt loop.

Type 'disconnect' or 'exit' to close the session and return to PowerShell. Type 'help' to see available Live Response commands.

Available Live Response commands include: analyze, cd, cls, connect, connections, dir, drivers, fg, fileinfo, findfile, getfile, help, jobs, library, log, persistence, prefetch, processes, putfile, registry, remediate, run, scheduledtasks, services, startupfolders, status, trace, undo

Command aliases (e.g. ls, process, download) are supported and resolved automatically. Use 'help <command>' for detailed syntax and flags for a specific command.

EXAMPLES​

EXAMPLE 1​

Connect-XdrEndpointDeviceLiveResponse -DeviceId "980dddb7036eae7e38d30dee7f11b51e573a6fc2"
Opens an interactive Live Response session to the specified device.

EXAMPLE 2​

$lr = Connect-XdrEndpointDeviceLiveResponse -DeviceId "980dddb7036eae7e38d30dee7f11b51e573a6fc2" -NonInteractive
Connects to the device and returns a session object for script-driven command execution.

EXAMPLE 3​

$devices | Connect-XdrEndpointDeviceLiveResponse -NonInteractive -NoStatusTable
Connects to multiple devices without rendering the live status table.

EXAMPLE 4​

Invoke-XdrEndpointDeviceAction -DeviceId "980dddb7036eae7e38d30dee7f11b51e573a6fc2" -LiveResponse
Opens a Live Response session via the unified action cmdlet.

PARAMETERS​

-DeviceId​

The device ID (SenseMachineId) of the target device.

Type: String
Parameter Sets: (All)
Aliases: MachineId, SenseMachineId

Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-DeviceName​

Optional device name used for progress display and to avoid an extra lookup when device metadata is already available from pipeline input.

Type: String
Parameter Sets: (All)
Aliases: ComputerDnsName

Required: False
Position: 2
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-LastSeen​

Optional last seen timestamp from pipeline input. When provided together with other device metadata, the cmdlet can reuse it during non-interactive session creation.

Type: Object
Parameter Sets: (All)
Aliases:

Required: False
Position: 3
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-OsPlatform​

Optional operating system platform from pipeline input. Used to determine the initial working directory without requiring an additional device metadata lookup.

Type: String
Parameter Sets: (All)
Aliases:

Required: False
Position: 4
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False

-NonInteractive​

Connects to Live Response and returns a session object without starting the interactive prompt loop.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-NoStatusTable​

Suppresses the live status table shown during multi-device non-interactive session creation. Returned session objects are unchanged.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ProgressAction​

The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.

Type: ActionPreference
Parameter Sets: (All)
Aliases: proga

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters​

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS​

OUTPUTS​

PSCustomObject​

When -NonInteractive is used, returns an XdrEndpointDeviceLiveResponseSession object.​

In interactive mode, no output is returned.​

NOTES​

macOS validation baseline: February 24, 2026.

Initial directory is OS-aware:

  • Windows devices start in C:\
  • macOS/Linux/Unix devices start in /

NonInteractive mode returns a typed XdrEndpointDeviceLiveResponseSession object for automation workflows and test harnesses.