# Run Live Response & Queries via Akto

## Overview

You can use **Microsoft Defender Run Queries** in Akto Atlas to discover agentic activity and endpoints directly from employee devices.

To access this feature, navigate to:

**Akto Atlas → Connectors → Microsoft Defender → Run Queries**

<div data-with-frame="true"><figure><img src="https://3128331180-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftog5ODwYfqPOf4eQhsOC%2Fuploads%2FlR5KOcsnDTv96YaUMZBO%2Fimage.png?alt=media&#x26;token=2c8f2913-663d-45e5-9d27-50a3c39a8646" alt="" width="563"><figcaption></figcaption></figure></div>

This integration allows you to:

* Run scripts on endpoints (**Live Response**)
* Query Defender telemetry (**KQL / Advanced Hunting**)

Both methods help you uncover API usage, shadow endpoints, and external services used across your organisation.

### What You Use This For in Akto

This feature has two clear purposes:

<table><thead><tr><th width="250.984375">Option</th><th width="489.26953125">Usecase</th></tr></thead><tbody><tr><td><a href="#option-1-run-live-response-scripts"><strong>Deploy Guardrails (Live Response)</strong></a></td><td>Remotely install Akto scripts for guardrails on endpoint devices.</td></tr><tr><td><a href="#option-2-run-kql-queries"><strong>Detect Agentic Applications (KQL Queries)</strong></a></td><td>Identify AI tools like Cursor, Claude, and similar applications running on endpoints.</td></tr></tbody></table>

## 1. **Set Up Microsoft Defender Connector**

Before running queries or deploying guardrails, you need to connect Microsoft Defender to Akto.

You can find this setup in:

**Akto Atlas → Connectors → Microsoft Defender for Endpoint**

In the connector setup screen, provide the following:

* **Tenant ID**
* **Client ID**
* **Client Secret**
* **Data Ingestion Service URL**
* **Polling Interval (seconds)**

  <div data-with-frame="true"><figure><img src="https://3128331180-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftog5ODwYfqPOf4eQhsOC%2Fuploads%2Fx2M2ztf0boHZ7F4D9klG%2Fimage.png?alt=media&#x26;token=bae2af0a-8873-4b21-a6d9-2dfccfb6b36a" alt="" width="375"><figcaption></figcaption></figure></div>

### Credentials & Permissions (Required)

Your Microsoft Defender API credentials must be configured with the following permissions for Live Response and KQL queries to function properly..

<details>

<summary><strong>Permission Required</strong></summary>

Your Microsoft Defender API token must include the following permissions:

<table><thead><tr><th width="244.35546875">Permission</th><th>Why it is required</th></tr></thead><tbody><tr><td><code>Machine.Scan</code></td><td>Allows scanning of endpoint devices to collect relevant security and system data</td></tr><tr><td><code>Ti.Read.All</code></td><td>Enables reading threat intelligence data for enrichment and analysis</td></tr><tr><td><code>User.Read.All</code></td><td>Provides visibility into user context associated with endpoint activity</td></tr><tr><td><code>Machine.ReadWrite.All</code></td><td>Allows managing and interacting with machines (required for executing actions like scripts)</td></tr><tr><td><code>Ti.ReadWrite.All</code></td><td>Enables updating and managing threat intelligence indicators if needed</td></tr><tr><td><code>Machine.LiveResponse</code></td><td><strong>Critical</strong> — allows running Live Response scripts to deploy Akto guardrails</td></tr><tr><td><code>Machine.RestrictExecution</code></td><td>Allows restricting execution on endpoints if guardrails require enforcement actions</td></tr><tr><td><code>Machine.StopAndQuarantine</code></td><td>Enables stopping or quarantining potentially risky processes if detected</td></tr><tr><td><code>Alert.Read.All</code></td><td>Allows reading alerts generated by Defender for visibility into endpoint risks</td></tr><tr><td><code>Software.Read.All</code></td><td><strong>Critical</strong> — required to detect installed software (used for identifying agentic apps like Cursor, Claude)</td></tr><tr><td><code>File.Read.All</code></td><td>Allows access to file-level metadata for deeper inspection if needed</td></tr><tr><td><code>Library.Manage</code></td><td>Enables managing the Live Response script library (uploading guardrail scripts)</td></tr><tr><td><code>Machine.Read.All</code></td><td>Provides basic read access to device inventory and metadata</td></tr><tr><td><code>Alert.ReadWrite.All</code></td><td>Allows updating or managing alerts if workflows require it</td></tr><tr><td><code>AdvancedQuery.Read.All</code></td><td><strong>Critical</strong> — required to run KQL queries for detecting agentic applications</td></tr></tbody></table>

</details>

## Option 1: Run Live Response Scripts

You run scripts on selected devices to actively collect data.

Use this when you want to:

* Deploy Akto collectors
* Extract API traffic or logs
* Gather system/network metadata from endpoints

<div data-with-frame="true"><figure><img src="https://3128331180-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftog5ODwYfqPOf4eQhsOC%2Fuploads%2F4ZwBbTPxOPZkDjBJQMVX%2Fimage.png?alt=media&#x26;token=dae7caf0-a27e-4b4a-98d4-9a758d8e356c" alt="" width="375"><figcaption></figcaption></figure></div>

### Steps to Run

{% stepper %}
{% step %}
**Select Live Response**

Choose **Live Response** from the Run Queries screen.
{% endstep %}

{% step %}
**Select Devices**

Search and select the devices where you want to run your script.

* You can select multiple devices
* Scripts will run sequentially on each device
  {% endstep %}

{% step %}
**Add Your Script**

You have two options:

* **Upload new script**
* **Use existing library script**

Supported formats:

* `.ps1` (Windows)
* `.sh` (macOS/Linux)
* `.bat`
  {% endstep %}

{% step %}
**(Optional) Add Script Parameters**

You can pass parameters to your script at runtime.

Example:

```
AKTO_PROXY_URL=https://example.ngrok-free.dev/v1
```

{% endstep %}

{% step %}
**Run the Script**

Click **Run on Selected Devices** to execute the script.
{% endstep %}
{% endstepper %}

### What Happens Next

* The script runs remotely via Microsoft Defender
* Guardrails are installed on each selected device
* Execution happens sequentially per endpoint

### Example Use Cases

You use Live Response primarily to:

* Deploy **Akto guardrails** across endpoint devices
* Enforce safe usage policies for agentic AI tools
* Standardize security controls across your organization

## Option 2: Run KQL Queries

You can query existing Microsoft Defender telemetry using Kusto Query Language (KQL).

You use KQL queries to:

* Detect installations of agentic tools such as:
  * Cursor
  * Claude
  * Other AI-assisted development tools
* Identify which devices are running these applications
* Monitor adoption and potential risk exposure

<div data-with-frame="true"><figure><img src="https://3128331180-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftog5ODwYfqPOf4eQhsOC%2Fuploads%2Fw64IxU6LOesp1ZFS8LfJ%2Fimage.png?alt=media&#x26;token=e561263b-1315-48ee-a26c-da7f913d0347" alt="" width="375"><figcaption></figcaption></figure></div>

### Steps to Run

{% stepper %}
{% step %}
**Select KQL Query**

Switch to the **KQL Query** tab.
{% endstep %}

{% step %}
**Enter Your Query**

Example:

```kql
DeviceNetworkEvents
| where RemotePort == 443
| project DeviceName, RemoteIP, RemoteUrl
| limit 100
```

{% endstep %}

{% step %}
**Run Query**

Click **Run Query** to execute.
{% endstep %}
{% endstepper %}

## What You Get

You’ll receive structured results showing:

* Devices with agentic tools installed
* Software versions
* Visibility into tool distribution across your organization

#### Best Practices for You

* Always filter results to keep queries fast
* Use `limit` to control output size
* Focus on relevant fields like `RemoteUrl`
* Start simple, then refine queries

## What Next

Now that you’ve configured and used Microsoft Defender Run Queries, you can proceed with:

* **Deploy via Microsoft Defender Endpoints**\
  Continue setting up endpoint-level integration and guardrail deployment:

  [](https://ai-security-docs.akto.io/akto-atlas-agentic-ai-security-for-employee-endpoints/endpoints-discovery-agents/deploy-via-microsoft-defender "mention")
* **Need Help?**\
  Reach out to the Akto team or explore support resources:

  [support](https://ai-security-docs.akto.io/troubleshooting/support "mention")


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ai-security-docs.akto.io/akto-atlas-agentic-ai-security-for-employee-endpoints/endpoints-discovery-agents/deploy-via-microsoft-defender/run-live-response-and-queries-via-akto.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.