Skip to content

Commit 804786b

Browse files
authored
Merge pull request #1828 from amirsc3/patch-2
Update troubleshoot-collect-support-log.md
2 parents 9cc9a81 + ea2739f commit 804786b

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

defender-endpoint/troubleshoot-collect-support-log.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ ms.collection:
1414
ms.topic: troubleshooting
1515
ms.subservice: edr
1616
search.appverid: met150
17-
ms.date: 09/03/2024
17+
ms.date: 11/07/2024
1818
---
1919

2020
# Collect support logs in Microsoft Defender for Endpoint using live response
@@ -34,8 +34,10 @@ This article provides instructions on how to run the tool via Live Response on W
3434
1. Download and fetch the required scripts available from within the **Tools** subdirectory of the [Microsoft Defender for Endpoint Client Analyzer](https://aka.ms/BetaMDEAnalyzer).
3535

3636
For example, to get the basic sensor and device health logs, fetch `..\Tools\MDELiveAnalyzer.ps1`.
37-
38-
If you also require Microsoft Defender Antivirus support logs (`MpSupportFiles.cab`), then fetch `..\Tools\MDELiveAnalyzerAV.ps1`.
37+
- If you require additional logs related to Microsoft Defender Antivirus, then use `..\Tools\MDELiveAnalyzerAV.ps1`.
38+
- If you require [Microsoft Endpoint Data Loss Prevention](/purview/endpoint-dlp-learn-about) related logs, then use `..\Tools\MDELiveAnalyzerDLP.ps1`.
39+
- If you require network and [Windows Filter Platform](/windows-hardware/drivers/network/windows-filtering-platform-architecture-overview) related logs, then use `..\Tools\MDELiveAnalyzerNet.ps1`.
40+
- If you require [Process Monitor](/sysinternals/downloads/procmon) logs, then use `..\Tools\MDELiveAnalyzerDLP.ps1`.
3941

4042
2. Initiate a [Live Response session](live-response.md#initiate-a-live-response-session-on-a-device) on the machine you need to investigate.
4143

0 commit comments

Comments
 (0)