Live Sessions

Three-Tab Diagnostic Modal

Live Sessions provide real-time, interactive diagnostics with a single agent. Click Live Session on any online agent to open the modal, which automatically starts ETW collection and establishes an SSE (Server-Sent Events) connection.

Query Tab

Natural language chat interface for AI-powered diagnostics:

  • Type questions in the input box and press Enter to send (Shift+Enter for new line)
  • Before answering, the agent runs an AI-driven dynamic ETW investigation against the target host: the AI picks ETW providers per round, captures evidence in a separate diagnostic session, and folds the counts-only findings into the answer prompt. See AI Diagnostics for the architecture — the short version is that the AI orchestrates which providers are listening, so the answer is grounded in evidence it actively gathered rather than a fixed always-on snapshot.
  • At the end of each round, a local rule engine on the agent scans the captured events for known failure patterns (Azure AD Conditional Access denials, TLS untrusted-root chains, Kerberos SPN failures, and others). Any verdicts that fire travel back with the round's counts summary so the AI planner sees them as authoritative findings. When a verdict already explains the symptom, the investigation often concludes in fewer rounds than the default cap of 5 — you'll see this as a faster time to answer for the common failure patterns.
  • You'll see streamed "thinking" messages while the investigation runs ("Starting live AI-driven ETW investigation…", "Round 2 of 3: capturing network-connections for 30s", etc.) so the wait is visible rather than opaque.
  • When the answer needs data the collected telemetry does not hold, the AI can run one read-only diagnostic command at a time on the host (PowerShell on Windows, bash on Linux), including registry reads. ET Ducky checks each command before the agent receives it. A command that cannot be shown to only read, or that reads a credential or key file, is not run; the answer names the command, the reason, and how to do the work another way.
  • Registry reads (Get-ItemProperty, Get-ItemPropertyValue, reg query) run, except reads of keys that hold stored secrets: Winlogon auto-logon, LSA secrets, saved PuTTY and WinSCP sessions, VNC and TeamViewer stored passwords, and SNMP community strings. A listing read (Get-ChildItem, -Recurse, /s or a wildcard) of one of those keys or a key above it is not run either, because it prints their values.
  • Responses include diagnostic findings, root cause analysis, and actionable recommendations. When the conclusion lends itself to an automated fix, a remediation script is proposed at the end of the session and submitted to the org's Process Automations approval flow — see the section below.
  • Conversation history supports up to 10 turns of context
  • Each question consumes 1 query from your organization pool, plus 1 query per round of the dynamic investigation (capped at 5 rounds default / 10 hard ceiling) and 1 more if a remediation script is generated.

Shell Tab

Remote command-line interface for direct execution on the agent:

  • Shell Type Toggle: Switch between PowerShell and CMD on Windows agents, and between Bash and Sh on Linux agents, via dropdown
  • Run as root (Linux): On a Linux agent, tick Run as root beside the shell type to run the next commands as root. The box starts unticked in every session. It needs the Linux root shell privilege, which owners hold and others are granted (see Team), and a host running a Linux agent newer than 2.8.5.3 where the administrator enabled it; otherwise the shell shows the server’s refusal. Each root command is recorded in the audit log. See Running commands as root.
  • sudo: On Linux agents newer than 2.8.5.3, typing sudo in the shell does not ask for a password. sudo fails at once, unless the agent’s sudoers policy covers the command, and the shell suggests Run as root. On Linux agents 2.8.5.3 and older, a sudo line in a Live Session still waits up to five minutes for a password prompt the dashboard does not show, and two such lines hold both of the agent’s shell slots; upgrade the agent.
  • Press Enter to execute; ↑/↓ arrow keys for command history
  • Copy on select: Tick Copy on select in the shell toolbar and highlighted output is copied to your clipboard when you release the mouse. It is off by default, and your browser remembers the choice.
  • Text size: A- and A+ in the toolbar, Ctrl+=, Ctrl+-, and Ctrl+0 while the Shell tab has focus, or Ctrl and the mouse wheel over the output change the size of the shell text only. Your browser remembers the size.
  • Full screen: The Full screen button fills the screen with the session. In Chrome and Edge, Ctrl+W then stays in the page and deletes the word before the cursor in the command line, instead of closing the browser tab. Outside full screen, and in other browsers, the browser handles Ctrl+W first. Press Esc to leave full screen.
  • Leaving the page: While a session is connected, closing or reloading the page asks you to confirm first.
  • Each command runs on its own with no interactive terminal, so full-screen programs such as nano, vim, and top don't run in the Shell tab.
  • Saved Scripts: Dropdown of pre-saved scripts with one-click execution. Script Manager to create, edit, delete.
  • Terminal-style output with exit codes, stdout, and stderr
  • Limits: 5-minute timeout per command. An agent runs at most 2 commands at a time (the ShellMaxConcurrentCommands setting, 1 to 8); a command sent while both are busy shows queued: waiting for a free shell slot and starts, in the order sent, when one finishes. From agent 2.8.4.9 each command runs once, even when it reaches the agent by both the push channel and the poll, and a command the server has already timed out is not started
  • Runs under: Agent service account (Local System for managed Windows agents, the unprivileged etducky account on Linux agents, or root on Linux with Run as root)
  • Blocked commands: commands that read credential or key files, weaken Microsoft Defender, or match another blocked pattern are refused. The error gives the reason and, where one exists, the route for legitimate work, such as a security review that approves the exact command.

Files Tab

Bidirectional file transfers between your browser and the agent:

  • Push File: Upload from browser with a destination path on the agent
  • Pull File: Download from agent by specifying a source path
  • Transferred in 1 MB chunks with MD5 verification
  • Real-time progress bars with percentage and byte count
  • Completed pulls show a Download button
  • Limits: Max 2 concurrent transfers; status refreshes every 5 seconds

Session Lifecycle

Starting

  1. Click Live Session on an online agent
  2. ETW collection initiates on the agent
  3. SSE connection establishes with QueryResponse, QueryFailed, and SessionEnded event handlers
  4. Three-tab modal opens — ready for queries

Ending

  1. Click End Session
  2. ETW collection stops on the agent
  3. SSE stream closes; agent returns to previous mode

Only one live session per agent at a time. Session history is not retained after closing.

Post-Session Remediation Offer

When an Automated Troubleshooting run concludes with a known fix, the AI generates a remediation script (PowerShell on Windows, Bash on Linux) and submits it to your org's Process Automations repository for review. You'll see a notice in the session stream when this happens (“Remediation script created and submitted for review (ticket #…)”) and the saved report's JSON will carry a remediation block with the script id, review ticket id, language, and an auto_run_eligible flag.

Auto-run eligibility distinguishes how the operator can execute the script after the org admin approves:

  • Live session, operator attending → auto_run_eligible = true. After approval, the operator can run the script in-session through the existing automations execution path.
  • Background / scheduled investigation, no operator → auto_run_eligible = false. Analysis-only; a human picks it up, reviews, and decides whether to run.

Either way, no remediation runs until an organization administrator approves the script. AI-generated remediations carry Origin = "process_automation" and a CreatedBy = "dynamic-etw:<jobId>" marker for the audit trail. See the Automations documentation for the full approval flow.

Effective Query Tips

  • Be Specific: “Why can't user John access \\server\share?” beats “Why doesn't this work?”
  • Include Context: Mention app names, file paths, service names, user accounts
  • Start Broad, Then Narrow: Overview first, then drill down
  • One Issue at a Time: Focus on a single problem for best correlation
  • Processing Time: Most queries return in 3–10 seconds