STIGQter: STIG Summary: Microsoft Defender for Endpoint Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Microsoft Defender for Endpoint (MDE) must enable Live Response for Servers.

DISA Rule

SV-275990r1119720_rule

Vulnerability Number

V-275990

Group Title

SRG-APP-000279

Rule Version

MSDE-00-001050

Severity

CAT II

CCI(s)

CCI-001243 - Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection.

Weight

Fix Recommendation

Access the MDE portal as a user with at least an MDE Administrator or equivalent role:

1. In the navigation pane, select Settings >> Endpoints >> Advanced features (under General).
2. Set the slide bar for "Live Response for Servers" to "On".

Check Contents

Access the MDE portal as a user with at least an MDE Administrator or equivalent role:

1. In the navigation pane, select Settings >> Endpoints >> Advanced features (under General).
2. Verify the slide bar for "Live Response for Servers" is set to "On".

If the slide bar for "Live Response for Servers" is not set to "On", this is a finding.

Vulnerability Number

V-275990

Documentable

False

Rule Version

MSDE-00-001050

Severity Override Guidance

Access the MDE portal as a user with at least an MDE Administrator or equivalent role:

1. In the navigation pane, select Settings >> Endpoints >> Advanced features (under General).
2. Verify the slide bar for "Live Response for Servers" is set to "On".

If the slide bar for "Live Response for Servers" is not set to "On", this is a finding.

Check Content Reference

Target Key

5693