Disconnect-XdrEndpointDeviceLiveResponse
SYNOPSIS
Closes an active Live Response session in Microsoft Defender XDR.
SYNTAX
Disconnect-XdrEndpointDeviceLiveResponse [-SessionId] <String> [-ProgressAction <ActionPreference>]
[<CommonParameters>]
DESCRIPTION
Closes an active Live Response session by calling the close_session API. This should be called when done with a Live Response session to free resources. Also clears the script-scoped LiveResponseSession variable if it matches.
EXAMPLES
EXAMPLE 1
Disconnect-XdrEndpointDeviceLiveResponse -SessionId "CLR0c33ce1c-1665-4e00-9059-8fa39da9e2cb"
Closes the specified Live Response session.
EXAMPLE 2
$sessions | Disconnect-XdrEndpointDeviceLiveResponse
Closes Live Response sessions passed through the pipeline.
PARAMETERS
-SessionId
The Live Response session ID to close (starts with CLR prefix).
Type: String
Parameter Sets: (All)
Aliases:
Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False
-ProgressAction
The ProgressAction parameter is a common parameter, not a cmdlet parameter. For more information, see about_CommonParameters.
Type: ActionPreference
Parameter Sets: (All)
Aliases: proga
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.