STIGQter: STIG Summary: Microsoft Defender for Endpoint Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Microsoft Defender for Endpoint (MDE) must enable Live Response.

DISA Rule

SV-275989r1119719_rule

Vulnerability Number

V-275989

Group Title

SRG-APP-000279

Rule Version

MSDE-00-001000

Severity

CAT II

CCI(s)

• CCI-001243 - Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection.

Weight

10

Fix Recommendation

Access the MDE portal as a user with at least an MDE Administrator or equivalent role:

1. In the navigation pane, select Settings >> Endpoints >> Advanced features (under General).
2. Set the slide bar for "Live Response" to "On".

Check Contents

Access the MDE portal as a user with at least an MDE Administrator or equivalent role:

1. In the navigation pane, select Settings >> Endpoints >> Advanced features (under General).
2. Verify the slide bar for "Live Response" is set to "On".

If the slide bar for "Live Response" is not set to "On", this is a finding.

Vulnerability Number

V-275989

Documentable

False

Rule Version

MSDE-00-001000

Severity Override Guidance

Access the MDE portal as a user with at least an MDE Administrator or equivalent role:

1. In the navigation pane, select Settings >> Endpoints >> Advanced features (under General).
2. Verify the slide bar for "Live Response" is set to "On".

If the slide bar for "Live Response" is not set to "On", this is a finding.

Check Content Reference

M

Target Key

5693