Endpoint: Timeline & Live Response

The device timeline: the crime scene recording

Investigating the device timeline

What the timeline shows

Event Type	What It Captures	Example
Process creation	New processes launched with command lines	powershell.exe -enc aQBlAHg...
File operations	Files created, modified, deleted, or renamed	C:\Temp\payload.exe created
Network connections	Outbound/inbound connections with IPs and ports	Connection to 198.51.100.42:443
Registry changes	Keys created, modified, or deleted	Run key added for persistence
Logon events	User logons, logoffs, RDP sessions	Interactive logon from 10.0.0.50
Alert events	Alerts generated by MDE on this device	”Suspicious PowerShell activity”

How to use the timeline

1. Start at the alert timestamp — what was happening when the alert fired?
2. Work backwards — what caused the malicious process to launch? What was the parent process?
3. Work forwards — what happened after the malicious activity? Did the attacker establish persistence?
4. Check network connections — did the malware phone home? What C2 server did it contact?
5. Check file operations — what files were created, downloaded, or exfiltrated?

Filtering the timeline

The timeline can be overwhelming on busy servers. Use filters:

• Event type — show only process creation, or only network events
• Time range — narrow to the investigation window
• Flag — show only flagged (suspicious) events
• Search — find specific file names, process names, or IP addresses

💡 Scenario: Elena traces malware on a payment server

Elena at Atlas Bank investigates a compromised payment server. The alert says: “Suspicious outbound connection from w3wp.exe.”

Timeline investigation:

• 14:23: w3wp.exe (IIS worker process) spawns cmd.exe
• 14:23: cmd.exe spawns powershell.exe with a Base64-encoded command
• 14:24: powershell.exe creates C:\Windows\Temp\update.exe
• 14:24: update.exe connects to 198.51.100.42:443 (C2 server)
• 14:25: update.exe creates a scheduled task for persistence
• 14:30: update.exe begins scanning internal network on port 445 (SMB)

Elena’s conclusion: Web shell uploaded to IIS → command execution → malware download → C2 connection → persistence → lateral movement attempt.

Live response

Live response opens a remote shell on the device — without needing RDP or physical access.

What you can do in live response

Command	What It Does
dir / cd	Navigate the file system
processes	List running processes with PIDs
getfile	Download a file from the device for analysis
putfile	Upload a file to the device (e.g., remediation script)
run	Execute a script on the device
remediate	Remove a file or kill a process
trace	Collect diagnostic trace data
connections	Show active network connections

When to use live response

• Collect a specific file for malware analysis (the malware binary, a suspicious script)
• Check running processes that might not appear in the timeline yet
• Run remediation scripts to clean up persistence mechanisms
• Collect memory dumps for advanced forensic analysis

💡 Exam tip: live response prerequisites

Live response requires:

1. Advanced feature enabled in MDE settings (Module 4)
2. Unsigned script execution enabled if running custom scripts
3. Appropriate RBAC permissions (Security Administrator or custom role)
4. Device must be online and communicating with MDE

If an exam question says “an analyst cannot start a live response session,” check these prerequisites.

Investigation packages

An investigation package is an automated forensic data collection. When you trigger it, MDE gathers:

Data	What It Contains
Autoruns	Programs that start automatically (startup, services, scheduled tasks)
Installed programs	Software installed on the device
Network connections	Active and recent connections with associated processes
Event logs	Security, System, and Application event logs
Prefetch files	Evidence of program execution history
Scheduled tasks	All configured scheduled tasks
Security product status	Defender AV status, last scan time, definitions version

The package is uploaded to the Defender portal for download and offline analysis.

Timeline for the past, live response for the present, investigation packages for evidence preservation

Feature	Device Timeline	Live Response	Investigation Package
When to use	Reconstruct past events	Investigate in real-time	Collect forensic evidence for offline analysis
Requires device online?	No — historical data stored in cloud	Yes — active connection needed	Yes — collection runs on device
Type of analysis	Chronological event review	Interactive investigation and remediation	Comprehensive forensic snapshot
Speed	Instant — data already in cloud	Real-time — you interact directly	Minutes — collection, then download
Best for	Understanding what happened	Investigating what is happening now	Preserving evidence for legal/compliance

Question

What six event types does the MDE device timeline capture?

Click or press Enter to reveal answer

Answer

1. Process creation (with command lines). 2. File operations (create, modify, delete). 3. Network connections (IPs, ports, processes). 4. Registry changes (keys, values). 5. Logon events (interactive, RDP, network). 6. Alert events (MDE-generated alerts on this device).

Click to flip back

Question

What can you do in a live response session?

Click or press Enter to reveal answer

Answer

Navigate the file system, list processes, download files (getfile), upload files (putfile), run scripts, remediate (remove files, kill processes), trace diagnostics, and view active network connections. Requires the Live Response advanced feature to be enabled.

Click to flip back

Question

What is an investigation package and when should you collect one?

Click or press Enter to reveal answer

Answer

An automated forensic data collection from a device — includes autoruns, installed programs, network connections, event logs, prefetch files, scheduled tasks, and security product status. Collect one when you need to preserve evidence for offline analysis, legal proceedings, or compliance requirements.

Click to flip back

Knowledge Check

Elena needs to download a suspicious file from a compromised server for malware analysis. The server is still online but she cannot RDP into it. What should she use?

AThe device timeline to view the file contentsBAdvanced Hunting to query the file hashCAn investigation package — it automatically collects all filesDLive response to navigate to the file and use 'getfile' to download it

Check Answer

Knowledge Check

Tyler wants to understand the exact sequence of events on a compromised developer workstation — what processes ran, what files were created, and what network connections were made. The workstation was isolated 2 hours ago. What tool should he use?

AThe device timeline — review historical events stored in the cloudBLive response — connect to the device and investigateCNetwork traffic capture from the firewallDAn investigation package

Check Answer

Knowledge Check

Elena is investigating a compromised payment server at Atlas Bank. The device timeline shows the attack started 3 days ago, but the server was isolated 2 hours ago. She needs to collect a malware binary from C:\\Windows\\Temp\\update.exe for forensic analysis. Which tool should she use and why?

ADevice timeline — it stores all files created on the deviceBInvestigation package — it automatically collects all executable filesCLive response — she can navigate to the file and download it, even on an isolated device, because live response maintains connectivity through the Defender channelDAdvanced Hunting — query DeviceFileEvents for the file hash and download it

Check Answer

🎬 Video coming soon

Next up: Device-level investigation is covered. Now let’s examine evidence and entities more deeply — tracing relationships between files, processes, and users across the investigation.