Defender Live Response The Device Network Settings Prevented Upload Download Of Files

403 views

Skip to first unread message

Matilda Equiluz

unread,

Jan 17, 2024, 10:59:47 AM1/17/24

to icinatex

Our client is using SONIC firewall and also using Microsoft Defender for Endpoint. There is a feature in Microsoft Defender for Endpoint "Automated investigation and response (AIR)" that run investigation on device that failed because of the error "Failed to upload SenseIR command outputs. The device network settings prevented upload/download of files". I search for a solution and found that issue can be fixed by exempting Microsoft application categories from full SSL inspection on firewall. So how to do it?

Microsoft Defender for Endpoints provides many tasks that you can perform on a machine to investigate and remediate risks. Of those tasks, Live Response can be one of the most powerful tools. Live Response is a MDE EDR capability that provides a security team immediate remote console access to a device. This provides the ability to perform in-depth investigative analysis on a potentially infected device. With Live response, you can hunt for malicious activities and files, collect those files for analysis, run scripts, and remediate threats all remotely. Live response can also be combined with device isolation to truly cut off the potential attack. Let us look at the requirements and tasks that you can perform with Live Response.

defender live response the device network settings prevented upload download of files

Download ✏ ✏ ✏ https://t.co/b50sQavfPA

The live response capability gives security operations teams instantaneous access to a device using a remote shell connection which is included in the portal. This feature has been integrated into the Microsoft 365 Defender Portal and can be enabled from the Advanced Features blade. For Live response, there are a couple of settings:

Live response is a function from Defender for Endpoint and is available for Windows 10 and Server 1803/1903. Live response gives security operations teams instantaneous access to a device using a remote shell connection. With live response it is possible to do an in-depth investigation and take immediate actions on the device level without any user interaction.

Now the live response session is started with the Sense IR is running and registered state. Time to run and start commands. In a critical situation it is also possible to isolate the machine first from the network by selecting isolate machine, after the isolate it is still possible to run a live respose session.

Then we have Microsoft Defender for Endpoint, where some more options are available. The first switch does enable supported agents to report status of profiles to Intune. Then there are few compliance policy settings and moreover app protection settings. All at the bottom there is a pie chart which shows how many Intune enrolled devices run the Microsoft Defender for Endpoint sensor.

Most Microsoft sites use cookies, small text files placed on your device which web servers utilize in the domain that placed the cookie can retrieve later. We use cookies to store your preferences and settings, help with sign-in, provide personalized ads, and analyze site operations. For more information, see the Cookies and similar technologies section of this privacy statement.

Content. Content of your files and communications you input, upload, receive, create, and control. For example, if you transmit a file using Skype to another Skype user, we need to collect the content of that file to display it to you and the other user. If you receive an email using Outlook.com, we need to collect the content of that email to deliver it to your inbox, display it to you, enable you to reply to it, and store it for you until you choose to delete it. Other content we collect when providing products to you include:

Cookies are small text files placed on your device to store data that can be recalled by a web server in the domain that placed the cookie. We use cookies and similar technologies for storing and honoring your preferences and settings, enabling you to sign in, providing interest-based advertising, combating fraud, analyzing how our products perform, and fulfilling other legitimate purposes. Microsoft apps use additional identifiers, such as the advertising ID in Windows described in the Advertising ID section of this privacy statement, for similar purposes.

Cookies are small text files placed on your device to store data that can be recalled by a web server in the domain that placed the cookie. This data often consists of a string of numbers and letters that uniquely identifies your computer, but it can contain other information as well. Some cookies are placed by third parties acting on our behalf. We use cookies and similar technologies to store and honor your preferences and settings, enable you to sign-in, provide interest-based advertising, combat fraud, analyze how our products perform, and fulfill other legitimate purposes described below. Microsoft apps use additional identifiers, such as the advertising ID in Windows, for similar purposes, and many of our websites and applications also contain web beacons or other similar technologies, as described below.

When you use OneDrive, we collect data about your usage of the service, as well as the content you store, to provide, improve, and protect the services. Examples include indexing the contents of your OneDrive documents so that you can search for them later and using location information to enable you to search for photos based on where the photo was taken. We also collect device information so we can deliver personalized experiences, such as enabling you to sync content across devices and roam customized settings.

When you share content to a social network like Facebook from a device that you have synced with your OneDrive account, your content is either uploaded to that social network, or a link to that content is posted to that social network. Doing this makes the content accessible to anyone on that social network. To delete the content, you need to delete it from the social network (if it was uploaded there, rather than a link to it) and from OneDrive.

When you add an account to Outlook, your mail, calendar items, files, contacts, settings and other data from that account will automatically sync to your device. If you are using the mobile Outlook application, that data will also sync to Microsoft servers to enable additional features such as faster search, personalized filtering of less important mail, and an ability to add email attachments from linked file storage providers without leaving the Outlook application. If you are using the desktop Outlook application, you can choose whether to allow the data to sync to our servers. At any time, you can remove an account or make changes to the data that is synced from your account.

Windows is a personalized computing environment that enables you to seamlessly roam and access services, preferences, and content across your computing devices from phones to tablets to the Surface Hub. Rather than residing as a static software program on your device, key components of Windows are cloud-based, and both cloud and local elements of Windows are updated regularly, providing you with the latest improvements and features. In order to provide this computing experience, we collect data about you, your device, and the way you use Windows. And because Windows is personal to you, we give you choices about the personal data we collect and how we use it. Note that if your Windows device is managed by your organization (such as your employer or school), your organization may use centralized management tools provided by Microsoft or others to access and process your data and to control device settings (including privacy settings), device policies, software updates, data collection by us or the organization, or other aspects of your device. Additionally, your organization may use management tools provided by Microsoft or others to access and process your data from that device, including your interaction data, diagnostic data, and the contents of your communications and files. For more information about data collection in Windows, see Data collection summary for Windows. This statement discusses Windows 10 and Windows 11 and references to Windows in this section relate to those product versions. Earlier versions of Windows (including Windows Vista, Windows 7, Windows 8, and Windows 8.1) are subject to their own privacy statements.

Text Messages. Phone Link allows you to view text messages delivered to your Android phone on your Windows device and send text messages from your Windows device. Only text messages received and sent within the last 30 days are visible on your Windows device. These text messages are temporarily stored on your Windows device. We never store your text messages on our servers or change or delete any text messages on your Android phone. You can see messages sent via SMS (Short Message Service) and MMS (Multimedia Messaging Service) on Android devices, and messages sent via RCS (Rich Communication Services) on select Samsung devices on select mobile operator networks. To provide this functionality, Phone Link accesses the content of your text messages and the contact information of the individuals or businesses from whom you are receiving or sending text messages.

The updated Photos app helps you organize, view, and share your photos and videos. For example, the Photos app presents different ways to group photos and videos by name, date taken, or date modified, and also in folders where those files are stored, such as stored locally on your device or synced to your device from OneDrive, iCloud, and other cloud services. The app also allows you to move, copy or upload files to different locations on your computer or to OneDrive. The All Photos tab displays your locally stored or synced photos and videos according to the date they are taken. The Favorites tab lets you view photos and videos you previously liked or favorited. The Folders tab allows you to view photos or videos by their storage location. There are also tabs where you can see your photos and videos from available cloud services (such as OneDrive and other third-party services) that you have synced to your device.