Live Response
Live Response runs vetted, catalogued commands on a live endpoint and streams output back to the console.
Live Response runs vetted, catalogued commands on a live endpoint and streams output back to the console. It is an interactive operational tool, not an arbitrary shell.
Catalog model
Section titled “Catalog model”Commands come from a server-provided catalog and are OS-badged. Safe read-only built-ins include examples such as listing files, reading bounded files, hashing files, inspecting sockets/network state, environment and process information.
Privileged commands — kill, remove, run a program, put-and-run, restart — are:
- hidden/disabled unless the operator has SuperAdmin;
- re-checked on the endpoint;
- confined where applicable to a quarantine root;
- checked against a destructive-form denylist.
There is deliberately no general interactive PTY or “run anything” command.
Workflow
Section titled “Workflow”- Search and select a device.
- Select a command supported by that device OS.
- Provide typed arguments.
- Run.
- Read streamed output frames in the output pane.
- Review the transcript in history.
- Export text/CSV if needed for evidence.
Progress is streamed over the real-time event client; the history table records the operation.
Guardrails
Section titled “Guardrails”| Guardrail | Why |
|---|---|
| Catalog command names | No arbitrary command line from the API |
| OS badge/gate | Stops Windows commands reaching Linux/macOS |
| Configurable execution timeout | Prevents permanently hung jobs |
| Bounded output frames | Protects the hub and browser |
| Role gating | Privileged operations require SuperAdmin |
| Endpoint re-check | A compromised console cannot remove all agent-side safety |
| Path confinement/denylist | Reduces destructive mistakes |
| Transcript | Preserves what was requested and returned |
Live Response versus Active Response
Section titled “Live Response versus Active Response”| Active Response | Live Response | |
|---|---|---|
| Purpose | Containment/remediation | Interactive investigation/operation |
| Model | Fixed typed containment actions | Catalogued commands with typed args |
| State | Durable desired/convergence record | Job/transcript history |
| Undo | Explicit inverse/expiry where reversible | Depends on command; not a containment feed |
Do not use Live Response to emulate containment when Active Response has a supported, reversible action.