You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 1 and contains a macOS device named Device1.
You need to investigate a Defender for Endpoint agent alert on Device1. The solution must meet the following requirements:
* Identify all the active network connections on Device1.
* Identify all the running processes on Device1.
* Retrieve the login history of Device1.
* Minimize administrative effort.
What should you do first from the Microsoft Defender portal?

Question

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 1 and contains a macOS device named Device1.

You need to investigate a Defender for Endpoint agent alert on Device1. The solution must meet the following requirements:

* Identify all the active network connections on Device1.

* Identify all the running processes on Device1.

* Retrieve the login history of Device1.

* Minimize administrative effort.

What should you do first from the Microsoft Defender portal?

Mark Oh · Accepted Answer

From Devices, click Collect investigation package for Device 1.

Mark Oh · Answer

From Advanced features in Endpoints, disable Authenticated telemetry.

Mark Oh · Answer

From Advanced features in Endpoints, enable Live Response unsigned script execution.

Mark Oh · Answer

From Devices, initiate a live response session on Device1.

List of questions