Run Script On Machine

Runs a script from the library on a device. The Arguments parameter is passed to your script. If not completed, the script will time out after 10 minutes.

The following permission is required to run this action:

• Machine.LiveResponse

External Documentation

To learn more, visit the Microsoft Defender For Endpoints documentation.

Parameters

Parameter	Description
Arguments	The program arguments the script will receive.
Comment	Comment to associate with the action.
Machine ID	The ID of the machine. Can be obtained using the List Machines action.
Script Name	The name of the script from the library you would like to run on the machine.

Example Output

{
    "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineActions/$entity",
    "id": "{machine_action_id}",
    "type": "LiveResponse",
    "requestor": "analyst@microsoft.com",
    "requestorComment": "Testing Live Response API",
    "status": "Pending",
    "machineId": "{machine_id}",
    "computerDnsName": "hostname",
    "creationDateTimeUtc": "2021-02-04T15:36:52.7788848Z",
    "lastUpdateDateTimeUtc": "2021-02-04T15:36:52.7788848Z",
    "errorHResult": 0,
    "commands": [
        {
            "index": 0,
            "startTime": null,
            "endTime": null,
            "commandStatus": "Created",
            "errors": [],
            "command": {
                "type": "RunScript",
                "params": [
                    {
                        "key": "ScriptName",
                        "value": "minidump.ps1"
                    },
                    {
                        "key": "Args",
                        "value": "OfficeClickToRun"
                    }
                ]
            }
        },
        {
            "index": 1,
            "startTime": null,
            "endTime": null,
            "commandStatus": "Created",
            "errors": [],
            "command": {
                "type": "GetFile",
                "params": [
                    {
                        "key": "Path",
                        "value": "C:\\windows\\TEMP\\OfficeClickToRun.dmp.zip"
                    }
                ]
            }
        }
    ]
}

Workflow Library Example

Run Script on Machine with Microsoft Defender for Endpoints and Send Results Via Email

Preview this Workflow on desktop