Live Response

Definitions

1. The practice of connecting to a live system during an incident to collect information, run limited commands, and sometimes contain activity without first taking the host offline. Live response is often used in endpoint and cloud investigations where speed matters and volatile context is valuable.

   In plain English: Interacting with a live system during an incident to gather evidence or contain damage.

   Example: "The SOC used live response to list processes and isolate the host before the attacker could pivot further."

Related Terms

• Incident Containment
• Automated Response
• BYOD Security
• Credential Cache
• Disk Forensics
• Emergency Patching
• Endpoint Compliance
• Endpoint Isolation
• Full Disk Encryption
• MDM
• Mean Time to Contain
• Quarantine