Defender Endpoint SenseIR Events - AIR and Live Response Under the Hood

Posted Jul 10, 2026

15 min read

Sometimes the interesting part of Defender for Endpoint is not only what you see in the Defender portal, but what the endpoint quietly records while the cloud service is doing its work.

I came across this again while looking at Automated Investigation and Response, usually shortened to AIR. At the time these events were captured, the portal provided the investigation story, verdicts, evidence, and remediation state. Locally, AIR and operator-driven Live Response used the same Defender incident-response module: SenseIR.exe. Its actions left a small but useful trail in the Microsoft-Windows-SenseIR event provider.

This is not a replacement for the Defender portal investigation view. Treat it as endpoint-side visibility: useful for learning, troubleshooting, and correlating what happened locally while AIR was running.

🧭 What AIR Does

Before September 1, 2026, Automated Investigation and Response was the separate Defender for Endpoint experience that started investigations from alerts or operator action, examined evidence, assigned verdicts, and could trigger remediation actions depending on the automation level and approvals in your tenant.

⚠️ Update - September 2026: Did you notice that Initiate investigation is no longer available as an automatic action for custom detections? This aligns with Microsoft’s change to Automated Investigation and Response (AIR) in Defender for Endpoint. As of September 1, 2026, AIR no longer runs as a separate investigation experience and cannot be triggered manually. Its detection and response capabilities are now included in Defender for Endpoint’s default antivirus protection stack and run automatically; for an on-demand investigation, run a full antivirus scan. Microsoft documents the transition here: https://learn.microsoft.com/en-us/defender-endpoint/automated-investigations

The remaining remediation actions for devices in a custom detection are:

Isolate device
Collect investigation package
Run antivirus scan
Restrict app execution

As a result, you should no longer expect the former AIR workflow to surface through Microsoft-Windows-SenseIR events in the same way shown below. The AIR-specific event examples in this post are retained as a historical reference. The observations for Live Response and Device/Network Discovery are unaffected by this change.

The separate AIR experience has since been retired, as explained in the warning above. The historical local event trail remains useful for understanding the collection and inspection actions that the former workflow performed on an endpoint. The Live Response and Device/Network Discovery observations remain relevant.

📡 The Local SenseIR Module

The local Defender module/binary behind these actions is:

C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe

Its corresponding Windows event provider is:

Microsoft-Windows-SenseIR

The name already hints at the purpose: Sense incident response. In the observations captured for this post, AIR and Live Response wrote to the same local event provider and used SenseIR.exe to perform their requested incident-response actions. Microsoft-Windows-SenseIR exposed the execution and result-upload trail from that module.

The beginning of an investigation may show a registration event:

ProviderName: Microsoft-Windows-SenseIR

TimeCreated          Id LevelDisplayName Message
-----------          -- ---------------- -------
21/06/2026 21:22:47   7 Information      Windows Defender Advanced Threat Protection Incident Response requested registration as an AIRS client. Result code: 0x0

After that, the more interesting rows are usually event 11, where results for individual actions were uploaded successfully:

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
21/06/2026 21:35:30    11 Information    Finished uploading results of action GetFileInformationAction. Action ID: iaid_3350_get_files_info__107_1783625674, upload result code: 0x0
21/06/2026 21:34:04    11 Information    Finished uploading results of action GetRecentlyCreatedOrModifiedExecutableFileListAction. Action ID: iaid_3349_get_recently_created_or_modified_executables__107_1783625634, upload result code: 0x0
21/06/2026 21:33:57    11 Information    Finished uploading results of action GetRecentlyExecutedFilesAction. Action ID: iaid_3346_get_recently_executed_files__107_1783625632, upload result code: 0x0
21/06/2026 21:33:56    11 Information    Finished uploading results of action GetFilesFromDownloadLocationsAction. Action ID: iaid_3348_get_files_from_download_locations__107_1783625633, upload result code: 0x0
21/06/2026 21:33:56    11 Information    Finished uploading results of action PersistenceCheckAction. Action ID: iaid_3347_get_autoruns__107_1783625632, upload result code: 0x0
21/06/2026 21:27:18    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3312_read_memory_content__107_1783625113, upload result code: 0x0
21/06/2026 21:27:17    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3314_read_memory_content__107_1783625055, upload result code: 0x0
21/06/2026 21:27:17    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3315_read_memory_content__107_1783625055, upload result code: 0x0
21/06/2026 21:26:43    11 Information    Finished uploading results of action GetFileInformationAction. Action ID: iaid_3313_get_files_info__107_1783625055, upload result code: 0x0
21/06/2026 21:26:17    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3301_read_memory_content__107_1783625054, upload result code: 0x0
21/06/2026 21:26:17    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3292_read_memory_content__107_1783625054, upload result code: 0x0
21/06/2026 21:26:16    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3300_read_memory_content__107_1783625054, upload result code: 0x0
21/06/2026 21:26:16    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3310_read_memory_content__107_1783625052, upload result code: 0x0
21/06/2026 21:26:15    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3298_read_memory_content__107_1783625052, upload result code: 0x0
21/06/2026 21:25:16    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3305_read_memory_content__107_1783625052, upload result code: 0x0
21/06/2026 21:25:15    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3311_read_memory_content__107_1783625052, upload result code: 0x0
21/06/2026 21:25:15    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3299_read_memory_content__107_1783625052, upload result code: 0x0
21/06/2026 21:25:15    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3303_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:25:15    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3307_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:25:14    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3306_read_memory_content__107_1783625052, upload result code: 0x0
21/06/2026 21:25:14    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3309_read_memory_content__107_1783625052, upload result code: 0x0
21/06/2026 21:24:15    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3296_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:24:14    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3304_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:24:14    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3302_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:24:14    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3308_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:24:14    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3297_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:24:14    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3291_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:24:14    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3290_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:24:13    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3295_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:24:13    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3293_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:24:12    11 Information    Finished uploading results of action ReadProcessMemoryAction. Action ID: iaid_3294_read_memory_content__107_1783625051, upload result code: 0x0
21/06/2026 21:23:43    11 Information    Finished uploading results of action GetProcessListAction. Action ID: iaid_3286_get_process_list__107_1783624973, upload result code: 0x0
21/06/2026 21:23:05    11 Information    Finished uploading results of action GetFileInformationAction. Action ID: iaid_3288_get_files_info__107_1783624982, upload result code: 0x0
21/06/2026 21:22:58    11 Information    Finished uploading results of action GetServiceListAction. Action ID: iaid_3287_get_service_list__107_1783624975, upload result code: 0x0
21/06/2026 21:22:56    11 Information    Finished uploading results of action GetDriverListAction. Action ID: iaid_3285_list_drivers__107_1783624973, upload result code: 0x0
21/06/2026 21:22:55    11 Information    Finished uploading results of action GetTcpConnectionListAction. Action ID: iaid_3284_get_connection_list__107_1783624973, upload result code: 0x0

This gives you a compact, local view of the collection sequence. In my sample, AIR collected network connections, drivers, services, processes, file information, process memory content, autoruns, recently executed files, and recently created or modified executables.

The event tells you that the endpoint finished and uploaded the result for an action. It does not show the full uploaded payload in the local event message, and it should not be treated as proof that a malicious verdict was reached.

🖥️ Live Response Uses the Same Local Module

I later compared this with a Live Response session. The actions were initiated interactively from Live Response, but the endpoint-side completion and upload events still appeared under Microsoft-Windows-SenseIR as event 11:

TimeCreated          Id LevelDisplayName Message
-----------          -- ---------------- -------
23/06/2026 18:26:18  11 Information      Finished uploading results of action PersistenceCheckAction. Action ID: c829585f-f72f-40ce-9f9f-e8422210bb19, upload result code: 0x0
23/06/2026 18:25:43  11 Information      Finished uploading results of action ReadFileAction. Action ID: 7a74b6d8-3ced-4f9f-be29-4d68e801f7a5, upload result code: 0x0
23/06/2026 18:25:40  11 Information      Finished uploading results of action GetFileInformationAction. Action ID: be0fce3d-7913-4a88-b8b4-926912c6d22a, upload result code: 0x0
23/06/2026 18:24:53  11 Information      Finished uploading results of action EnumerateFilesAndFoldersAction. Action ID: 9af2d12d-55ea-440d-aef5-41ee079c0570, upload result code: 0x0
23/06/2026 18:24:43  11 Information      Finished uploading results of action FileExistsAction. Action ID: b8be0fef-a3d3-4020-87fc-fd56ac61c893, upload result code: 0x0
23/06/2026 18:24:10  11 Information      Finished uploading results of action GetTcpConnectionListAction. Action ID: f58a771a-441b-4a4d-8f2e-60a05966d162, upload result code: 0x0
23/06/2026 18:23:31  11 Information      Finished uploading results of action GetFileInformationAction. Action ID: c8fcc68e-c341-4af1-bdd1-bd0f37922a9b, upload result code: 0x0
23/06/2026 18:22:38  11 Information      Finished uploading results of action PersistenceCheckAction. Action ID: 7b22cbaf-d10b-4b24-aeca-d8d746300373, upload result code: 0x0
23/06/2026 18:21:56  11 Information      Finished uploading results of action EnumerateFilesAndFoldersAction. Action ID: 06a6e948-460f-4ec8-ae20-6aa65f2a0a9b, upload result code: 0x0
23/06/2026 18:21:14  11 Information      Finished uploading results of action GetFileInformationAction. Action ID: 4667d2e3-dae4-4ba1-a4e8-4d2513fcfa68, upload result code: 0x0
23/06/2026 18:21:07  11 Information      Finished uploading results of action GetFileInformationAction. Action ID: fce4e7f7-162e-47cf-a8e2-7d869515b8c6, upload result code: 0x0
23/06/2026 18:20:50  11 Information      Finished uploading results of action GetFileInformationAction. Action ID: 3f65f8de-68ab-4a4b-8ff3-c92515e5547b, upload result code: 0x0
23/06/2026 18:20:32  11 Information      Finished uploading results of action FindFilesAction. Action ID: a00c10c1-58b8-4fcd-a272-e5233097a8ed, upload result code: 0x0
23/06/2026 18:14:23  11 Information      Finished uploading results of action PersistenceCheckAction. Action ID: b8482811-9316-403a-8a02-58dfad6a7292, upload result code: 0x0
23/06/2026 18:14:02  11 Information      Finished uploading results of action GetTcpConnectionListAction. Action ID: 3028901e-6fd5-4df9-9bef-9443b5012db0, upload result code: 0x0
23/06/2026 18:13:07  11 Information      Finished uploading results of action EnumerateFilesAndFoldersAction. Action ID: 0d4d495a-0cc8-4c31-a3b9-8caa1c62fed3, upload result code: 0x0
23/06/2026 18:12:51  11 Information      Finished uploading results of action PersistenceCheckAction. Action ID: b8a7af0b-842e-4412-823e-24cd10c2b732, upload result code: 0x0
23/06/2026 18:12:39  11 Information      Finished uploading results of action GetServiceListAction. Action ID: 18e29434-68af-45f9-8dd1-5e56f644d3d7, upload result code: 0x0
23/06/2026 18:12:25  11 Information      Finished uploading results of action GetProcessListAction. Action ID: 6350af59-d86a-452d-b8ff-ace03831ddd8, upload result code: 0x0
23/06/2026 18:11:59  11 Information      Finished uploading results of action GetDriverListAction. Action ID: 936dd2bf-3f5c-4844-9790-bc60b27dfb9c, upload result code: 0x0

This is the useful finding. Although the work was requested through a remote Live Response session, the same local SenseIR.exe module used for AIR performed the individual actions. Microsoft-Windows-SenseIR is the event trail showing their result uploads; the shared provider is a consequence of the shared local module, not the main point by itself.

This observation confirms that AIR and Live Response both rely on the SenseIR.exe module.

Live Response examples: https://learn.microsoft.com/en-us/defender-endpoint/live-response-command-examples

Distinguishing the Source in Event 11

Although the workflows use the same event provider and event ID, the Action ID gives us a practical local clue about where the action came from. In my samples, AIR action IDs use an iaid_ prefix followed by an internal sequence and action name, while actions started through Live Response use a plain GUID. I also found action IDs starting with eeaid_, which appear to be related to Defender for Endpoint Device Discovery or Network Discovery activity:

Possible source	Observed `Action ID` format	Example
AIR	Starts with `iaid_`	`iaid_3299_read_memory_content__107_1783625052`
Live Response	GUID without the `iaid_` prefix	`6350af59-d86a-452d-b8ff-ace03831ddd8`
Device/Network Discovery	Starts with `eeaid_`	`eeaid_...`

That means event 11 can be classified locally with a simple check: an iaid_ prefix is consistent with AIR, an eeaid_ prefix may indicate Device/Network Discovery, and a GUID-shaped ID is consistent with Live Response.

  
$source = Get-DefenderSenseIRActionSource -ActionId $actionId

⚠️ This distinction is based entirely on locally observed Action ID formats. Microsoft does not document these prefixes as a supported way to identify the source. In particular, my association of eeaid_ with Device/Network Discovery is only my current interpretation of the surrounding activity - it is not proven or confirmed by official documentation. Treat all three patterns as correlation clues, not a permanent contract.

More detailed information around Defender device/network discovery can be found here: https://pisinger.github.io/posts/defender-network-discovery-under-the-hood/

🔍 Reading the Action Names

The action names are the useful part. They map nicely to the type of triage an analyst would normally perform manually:

Action	What it suggests `SenseIR.exe` collected
`GetTcpConnectionListAction`	Active or recent TCP connection state
`GetDriverListAction`	Loaded driver inventory
`GetServiceListAction`	Service inventory
`GetProcessListAction`	Running process inventory
`GetFileInformationAction`	Metadata for files of interest
`ReadFileAction`	Content read from a selected file
`FileExistsAction`	Check whether a specified file or path exists
`FindFilesAction`	Search for files matching supplied criteria
`EnumerateFilesAndFoldersAction`	Directory and file enumeration for a selected path
`ReadProcessMemoryAction`	Memory content from selected processes
`PersistenceCheckAction`	Autoruns and other persistence locations
`GetRecentlyExecutedFilesAction`	Recently executed file evidence
`GetFilesFromDownloadLocationsAction`	Files from common download paths
`GetRecentlyCreatedOrModifiedExecutableFileListAction`	New or modified executable content

That list is not the full internal playbook, and it may change over time. Still, it is enough to understand the shape of the former standalone investigation. AIR did more than scan the box: it performed targeted evidence collection, uploaded the results, and let the service-side investigation engine reason over that evidence.

🛠️ PowerShell Helper

Below is the combined helper I use for this. The first function reads Microsoft-Windows-SenseIR and keeps only a few practical filters. Get-DefenderSenseIRActionSource classifies the observed Action ID formats, while the final function wraps the event reader for the AIR and Live Response action events I usually care about.

  
function Get-DefenderEventsSenseIR {
    param (
        [string]$Pattern,
        [switch]$Filtered
    )

    $ids = 1..5

    $events = Get-WinEvent -ErrorAction SilentlyContinue -FilterHashTable @{
        ProviderName = "Microsoft-Windows-SenseIR"
    }

    if ($Filtered) {
        $events = $events | Where-Object Id -notin $ids
    }

    if ($Pattern) {
        $events = $events | Where-Object Message -like "*$Pattern*"
    }

    return $events
}

function Get-DefenderSenseIRActionSource {
    param (
        [Parameter(Mandatory)]
        [string]$ActionId
    )

    if ($ActionId -like "iaid_*") {
        return "AIR"
    }

    if ($ActionId -like "eeaid_*") {
        return "Network Discovery"
    }

    if ($ActionId -match "^[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}$") {
        return "Live Response"
    }

    return "Unknown"
}

function Get-DefenderEventsSenseAutomatedInvestigation {
    param (
        [switch]$ActionReportOnly
    )

    $ids = 7, 11
    $events = Get-DefenderEventsSenseIR | Where-Object Id -in $ids

    if ($ActionReportOnly) {
        $events = $events | Where-Object Id -eq 11
    }

    return $events
}

The Get-DefenderEventsSenseAutomatedInvestigation wrapper focuses on two event IDs:

Event ID	Why I look at it
`7`	AIRS client registration request
`11`	Finished upload for an investigation action

For Live Response, I keep 1, 3, 11, and 14 in the wrapper. Event 11 is still the most useful report-style signal because it records that results for an action were uploaded.

⚡ Quick Usage

To list AIR-related local events:

  
Get-DefenderEventsSenseAutomatedInvestigation |
    Select-Object TimeCreated, Id, LevelDisplayName, Message

To only show action upload reports:

  
Get-DefenderEventsSenseAutomatedInvestigation -ActionReportOnly |
    Select-Object TimeCreated, Id, Message

To quickly extract the action names from event 11:

  
Get-DefenderEventsSenseAutomatedInvestigation -ActionReportOnly |
    ForEach-Object {
        $actionId = [regex]::Match($_.Message, "Action ID: (?<id>[^,]+)").Groups["id"].Value

        [pscustomobject]@{
            TimeCreated = $_.TimeCreated
            Action      = [regex]::Match($_.Message, "action (?<action>[^.]+)\.").Groups["action"].Value
            ActionId    = $actionId
            Source      = Get-DefenderSenseIRActionSource -ActionId $actionId
            ResultCode  = [regex]::Match($_.Message, "upload result code: (?<code>\S+)").Groups["code"].Value
        }
    } |
    Sort-Object TimeCreated

That produces a much cleaner sequence:

TimeCreated          Action                                               Source  ResultCode
-----------          ------                                               ------  ----------
21/06/2026 21:22:55  GetTcpConnectionListAction                           AIR     0x0
21/06/2026 21:22:56  GetDriverListAction                                  AIR     0x0
21/06/2026 21:22:58  GetServiceListAction                                 AIR     0x0
21/06/2026 21:23:43  GetProcessListAction                                 AIR     0x0
21/06/2026 21:24:12  ReadProcessMemoryAction                              AIR     0x0
21/06/2026 21:33:56  PersistenceCheckAction                               AIR     0x0
21/06/2026 21:33:57  GetRecentlyExecutedFilesAction                       AIR     0x0
21/06/2026 21:34:04  GetRecentlyCreatedOrModifiedExecutableFileListAction AIR     0x0

💡 Why This Is Useful

For me, this is mainly useful in two situations.

Learning how AIR behaved. Seeing the action names in order makes the former investigation workflow less abstract. You get a feeling for the evidence classes Defender collected.

Troubleshooting local execution. For Live Response, matching portal activity with Microsoft-Windows-SenseIR events can still provide a useful clue. The older AIR examples can also help when reviewing historical activity from before the standalone experience was retired.

There are also a few limits to keep in mind:

The local event log does not contain the full investigation result.
Action names and IDs are internal implementation details and can change.
Retention depends on the local event log configuration.
Some activity may be easier to understand from the Defender portal timeline or Advanced Hunting.

That last point matters. Local logs are a supporting signal, not the source of truth for investigation outcome.

✅ Conclusion

In the observations captured before September 1, 2026, SenseIR.exe was the common local Defender incident-response module behind both the standalone AIR workflow and Live Response. Microsoft-Windows-SenseIR provided a useful window into that module: it showed when the endpoint registered as an incident response client and, more importantly, which locally executed actions finished and uploaded their results. In event 11, the observed Action ID format also provided a practical source clue: iaid_ for AIR, a plain GUID for Live Response, and possibly eeaid_ for Device/Network Discovery.

The AIR-specific examples are now a historical view rather than a current validation method: the former standalone workflow should no longer be expected to reveal itself through these events in the same way. For Live Response and Device/Network Discovery, however, the local trail and the Action ID patterns remain useful correlation clues.

blogging

This post is licensed under CC BY 4.0 by the author.

Defender Endpoint SenseIR Events - AIR and Live Response Under the Hood

🧭 What AIR Does

📡 The Local SenseIR Module

🖥️ Live Response Uses the Same Local Module

Distinguishing the Source in Event 11

🔍 Reading the Action Names

🛠️ PowerShell Helper

⚡ Quick Usage

💡 Why This Is Useful

✅ Conclusion

Get in touch

Trending Tags