Invoke-XdrEndpointDeviceLiveResponseCommand
SYNOPSIS
Sends a command to an active Live Response session in Microsoft Defender XDR.
SYNTAX
Invoke-XdrEndpointDeviceLiveResponseCommand [-SessionId] <String> [-Command] <String>
[[-CurrentDirectory] <String>] [-BackgroundMode] [[-TimeoutSeconds] <Int32>] [[-PollIntervalSeconds] <Int32>]
[[-CommandDefinitions] <Array>] [[-DeviceName] <String>] [[-DeviceId] <String>] [-ExpandTableOutput]
[-IncludeCommandResult] [-RawCommandResult] [-ProgressAction <ActionPreference>] [<CommonParameters>]
DESCRIPTION
Submits a command to an active Live Response session and polls for the result. Parses the raw command line to extract the command definition ID and parameters, then sends the command via the Live Response API and waits for completion.
Supports the full Live Response command syntax including:
- Positional parameters mapped by order from the command definition
- Named parameters using -paramName value syntax (e.g. -output json, -name notepad.exe)
- Boolean flags using -flagName syntax (e.g. -full_path, -upload, -overwrite, -keep)
- Alias resolution (ls -> dir, process -> processes, download -> getfile, etc.)
This cmdlet can be used programmatically or is called automatically by Connect-XdrEndpointDeviceLiveResponse during interactive sessions.
EXAMPLES
EXAMPLE 1
Invoke-XdrEndpointDeviceLiveResponseCommand -SessionId "CLR0c33ce1c-1665-4e00-9059-8fa39da9e2cb" -Command "processes"
Lists running processes on the remote device.
EXAMPLE 2
Invoke-XdrEndpointDeviceLiveResponseCommand -SessionId "CLR0c33ce1c-1665-4e00-9059-8fa39da9e2cb" -Command "dir /Applications" -CurrentDirectory "/"
Lists the contents of /Applications on a macOS device.
EXAMPLE 3
Invoke-XdrEndpointDeviceLiveResponseCommand -SessionId "CLR0c33ce1c-1665-4e00-9059-8fa39da9e2cb" -Command "dir -full_path"
Lists all files with full paths. The -full_path flag is correctly sent in the flags[] array.
EXAMPLE 4
Invoke-XdrEndpointDeviceLiveResponseCommand -SessionId "CLR0c33ce1c-1665-4e00-9059-8fa39da9e2cb" -Command "process -name launchd"
Filters processes by name using the 'process' alias and a named -name parameter on macOS.
EXAMPLE 5
Invoke-XdrEndpointDeviceLiveResponseCommand -SessionId "CLR0c33ce1c-1665-4e00-9059-8fa39da9e2cb" -Command "getfile /etc/hosts" -TimeoutSeconds 120
Downloads a file from a macOS device with a 2-minute timeout.
EXAMPLE 6
Invoke-XdrEndpointDeviceLiveResponseCommand -SessionId "CLR0c33ce1c-1665-4e00-9059-8fa39da9e2cb" -Command "ls"
Lists files using the 'ls' alias for 'dir'. Alias is preserved in raw_command_line.
EXAMPLE 7
$sessions | Invoke-XdrEndpointDeviceLiveResponseCommand -Command "processes" -ExpandTableOutput
Returns one PowerShell object per process row, stamped with device and execution metadata.
EXAMPLE 8
$sessions | Invoke-XdrEndpointDeviceLiveResponseCommand -Command "processes" -ExpandTableOutput -IncludeCommandResult
Returns the original command result object followed by flattened process rows.
EXAMPLE 9
Invoke-XdrEndpointDeviceLiveResponseCommand -SessionId "CLR0c33ce1c-1665-4e00-9059-8fa39da9e2cb" -Command "drivers" -RawCommandResult
Returns the original command result object without expanding structured table rows.
PARAMETERS
-SessionId
The Live Response session ID (starts with CLR prefix).
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False
-Command
The raw command line to execute (e.g., "dir /Applications", "processes", "getfile /etc/hosts"). Supports all Live Response command aliases (ls, process, download, etc.). Values containing spaces must be quoted: getfile "/Applications/Utilities/Activity Monitor.app/Contents/Info.plist"
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 2
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-CurrentDirectory
The current working directory on the remote device. Defaults to "C:" for Windows sessions. For macOS and Linux sessions, use '/' or the session's reported current directory.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 3
Default value: C:\
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-BackgroundMode
Run the command in background mode if supported.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-TimeoutSeconds
Maximum time to wait for command completion. Defaults to 300 seconds (5 minutes). Automatically extended to 600s for analyze commands.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 4
Default value: 300
Accept pipeline input: False
Accept wildcard characters: False
-PollIntervalSeconds
How often to check for command completion. Defaults to 2 seconds.
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: 5
Default value: 2
Accept pipeline input: False
Accept wildcard characters: False
-CommandDefinitions
Array of command definition objects from the Live Response API's get_command_definitions endpoint. Used to resolve aliases and correctly classify -name tokens as flags or named parameters. When not provided, falls back to heuristic parsing with 'path' as the default param_id.
Type: Array
Parameter Sets: (All)
Aliases:
Required: False
Position: 6
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-DeviceName
Optional device name to stamp onto the returned command object.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 7
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-DeviceId
Optional device ID to stamp onto the returned command object.
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: 8
Default value: None
Accept pipeline input: True (ByPropertyName)
Accept wildcard characters: False
-ExpandTableOutput
When set, emits PowerShell-native row objects for table outputs and stamps each row with Timestamp, DeviceName, DeviceId, command, and status metadata.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-IncludeCommandResult
When used with -ExpandTableOutput, also emits the original command result object before the flattened table rows.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-RawCommandResult
Returns the original command result object without default structured table expansion. Useful for callers such as the interactive Live Response shell that need the raw outputs, context, and error collections from the API response.
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.
INPUTS
OUTPUTS
PSCustomObject
Returns the command result object including output, status, context, and errors.
With -ExpandTableOutput, returns flattened table row objects when table outputs are present.
NOTES
macOS validation baseline: February 24, 2026.
Use POSIX-style paths for macOS sessions (for example: /, /Applications, /etc/hosts, /tmp).
Some Live Response commands are platform-restricted or tenant-policy restricted and can return errors such as "Not allowed to run this command". These responses should be recorded as capability limitations instead of parser failures.