# Run Live Response & Queries via Akto

## Overview

You can use **Microsoft Defender Run Queries** in Akto Atlas to discover agentic activity and endpoints directly from employee devices.

To access this feature, navigate to:

**Akto Atlas → Connectors → Microsoft Defender → Run Queries**

<div data-with-frame="true"><figure><img src="https://3128331180-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftog5ODwYfqPOf4eQhsOC%2Fuploads%2FlR5KOcsnDTv96YaUMZBO%2Fimage.png?alt=media&#x26;token=2c8f2913-663d-45e5-9d27-50a3c39a8646" alt="" width="563"><figcaption></figcaption></figure></div>

This integration allows you to:

* Run scripts on endpoints (**Live Response**)
* Query Defender telemetry (**KQL / Advanced Hunting**)

Both methods help you uncover API usage, shadow endpoints, and external services used across your organisation.

### What You Use This For in Akto

This feature has two clear purposes:

<table><thead><tr><th width="250.984375">Option</th><th width="489.26953125">Usecase</th></tr></thead><tbody><tr><td><a href="#option-1-run-live-response-scripts"><strong>Deploy Guardrails (Live Response)</strong></a></td><td>Remotely install Akto scripts for guardrails on endpoint devices.</td></tr><tr><td><a href="#option-2-run-kql-queries"><strong>Detect Agentic Applications (KQL Queries)</strong></a></td><td>Identify AI tools like Cursor, Claude, and similar applications running on endpoints.</td></tr></tbody></table>

## 1. **Set Up Microsoft Defender Connector**

Before running queries or deploying guardrails, you need to connect Microsoft Defender to Akto.

You can find this setup in:

**Akto Atlas → Connectors → Microsoft Defender for Endpoint**

In the connector setup screen, provide the following:

* **Tenant ID**
* **Client ID**
* **Client Secret**
* **Data Ingestion Service URL**
* **Polling Interval (seconds)**

  <div data-with-frame="true"><figure><img src="https://3128331180-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftog5ODwYfqPOf4eQhsOC%2Fuploads%2Fx2M2ztf0boHZ7F4D9klG%2Fimage.png?alt=media&#x26;token=bae2af0a-8873-4b21-a6d9-2dfccfb6b36a" alt="" width="375"><figcaption></figcaption></figure></div>

### Credentials & Permissions (Required)

Your Microsoft Defender API credentials must be configured with the following permissions for Live Response and KQL queries to function properly..

<details>

<summary><strong>Permission Required</strong></summary>

Your Microsoft Defender API token must include the following permissions:

<table><thead><tr><th width="244.35546875">Permission</th><th>Why it is required</th></tr></thead><tbody><tr><td><code>Machine.Scan</code></td><td>Allows scanning of endpoint devices to collect relevant security and system data</td></tr><tr><td><code>Ti.Read.All</code></td><td>Enables reading threat intelligence data for enrichment and analysis</td></tr><tr><td><code>User.Read.All</code></td><td>Provides visibility into user context associated with endpoint activity</td></tr><tr><td><code>Machine.ReadWrite.All</code></td><td>Allows managing and interacting with machines (required for executing actions like scripts)</td></tr><tr><td><code>Ti.ReadWrite.All</code></td><td>Enables updating and managing threat intelligence indicators if needed</td></tr><tr><td><code>Machine.LiveResponse</code></td><td><strong>Critical</strong> — allows running Live Response scripts to deploy Akto guardrails</td></tr><tr><td><code>Machine.RestrictExecution</code></td><td>Allows restricting execution on endpoints if guardrails require enforcement actions</td></tr><tr><td><code>Machine.StopAndQuarantine</code></td><td>Enables stopping or quarantining potentially risky processes if detected</td></tr><tr><td><code>Alert.Read.All</code></td><td>Allows reading alerts generated by Defender for visibility into endpoint risks</td></tr><tr><td><code>Software.Read.All</code></td><td><strong>Critical</strong> — required to detect installed software (used for identifying agentic apps like Cursor, Claude)</td></tr><tr><td><code>File.Read.All</code></td><td>Allows access to file-level metadata for deeper inspection if needed</td></tr><tr><td><code>Library.Manage</code></td><td>Enables managing the Live Response script library (uploading guardrail scripts)</td></tr><tr><td><code>Machine.Read.All</code></td><td>Provides basic read access to device inventory and metadata</td></tr><tr><td><code>Alert.ReadWrite.All</code></td><td>Allows updating or managing alerts if workflows require it</td></tr><tr><td><code>AdvancedQuery.Read.All</code></td><td><strong>Critical</strong> — required to run KQL queries for detecting agentic applications</td></tr></tbody></table>

</details>

## Option 1: Run Live Response Scripts

You run scripts on selected devices to actively collect data.

Use this when you want to:

* Deploy Akto collectors
* Extract API traffic or logs
* Gather system/network metadata from endpoints

<div data-with-frame="true"><figure><img src="https://3128331180-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftog5ODwYfqPOf4eQhsOC%2Fuploads%2F4ZwBbTPxOPZkDjBJQMVX%2Fimage.png?alt=media&#x26;token=dae7caf0-a27e-4b4a-98d4-9a758d8e356c" alt="" width="375"><figcaption></figcaption></figure></div>

### Steps to Run

{% stepper %}
{% step %}
**Select Live Response**

Choose **Live Response** from the Run Queries screen.
{% endstep %}

{% step %}
**Select Devices**

Search and select the devices where you want to run your script.

* You can select multiple devices
* Scripts will run sequentially on each device
  {% endstep %}

{% step %}
**Add Your Script**

You have two options:

* **Upload new script**
* **Use existing library script**

Supported formats:

* `.ps1` (Windows)
* `.sh` (macOS/Linux)
* `.bat`
  {% endstep %}

{% step %}
**(Optional) Add Script Parameters**

You can pass parameters to your script at runtime.

Example:

```
AKTO_PROXY_URL=https://example.ngrok-free.dev/v1
```

{% endstep %}

{% step %}
**Run the Script**

Click **Run on Selected Devices** to execute the script.
{% endstep %}
{% endstepper %}

### What Happens Next

* The script runs remotely via Microsoft Defender
* Guardrails are installed on each selected device
* Execution happens sequentially per endpoint

### Example Use Cases

You use Live Response primarily to:

* Deploy **Akto guardrails** across endpoint devices
* Enforce safe usage policies for agentic AI tools
* Standardize security controls across your organization

## Option 2: Run KQL Queries

You can query existing Microsoft Defender telemetry using Kusto Query Language (KQL).

You use KQL queries to:

* Detect installations of agentic tools such as:
  * Cursor
  * Claude
  * Other AI-assisted development tools
* Identify which devices are running these applications
* Monitor adoption and potential risk exposure

<div data-with-frame="true"><figure><img src="https://3128331180-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Ftog5ODwYfqPOf4eQhsOC%2Fuploads%2Fw64IxU6LOesp1ZFS8LfJ%2Fimage.png?alt=media&#x26;token=e561263b-1315-48ee-a26c-da7f913d0347" alt="" width="375"><figcaption></figcaption></figure></div>

### Steps to Run

{% stepper %}
{% step %}
**Select KQL Query**

Switch to the **KQL Query** tab.
{% endstep %}

{% step %}
**Enter Your Query**

Example:

```kql
DeviceNetworkEvents
| where RemotePort == 443
| project DeviceName, RemoteIP, RemoteUrl
| limit 100
```

{% endstep %}

{% step %}
**Run Query**

Click **Run Query** to execute.
{% endstep %}
{% endstepper %}

## What You Get

You’ll receive structured results showing:

* Devices with agentic tools installed
* Software versions
* Visibility into tool distribution across your organization

#### Best Practices for You

* Always filter results to keep queries fast
* Use `limit` to control output size
* Focus on relevant fields like `RemoteUrl`
* Start simple, then refine queries

## What Next

Now that you’ve configured and used Microsoft Defender Run Queries, you can proceed with:

* **Deploy via Microsoft Defender Endpoints**\
  Continue setting up endpoint-level integration and guardrail deployment:

  [](https://ai-security-docs.akto.io/akto-atlas-agentic-ai-security-for-employee-endpoints/endpoints-discovery-agents/deploy-via-microsoft-defender "mention")
* **Need Help?**\
  Reach out to the Akto team or explore support resources:

  [support](https://ai-security-docs.akto.io/troubleshooting/support "mention")