When establishing and using a Live Response session, there are several concepts to consider to improve the results.

For details regarding Live Response support, review the VMware Carbon Black Cloud™ Audit and Remediation Operating Environment Requirements.

The following list of Live Response considerations are established to:

  • Protect the system from being overloaded: Max concurrent sessions, session commands, and command size.
  • Protect the network from being overloaded: Max concurrent sessions and timeouts.

Live Response Considerations:

  • The limit for concurrent Live Response sessions is 100.
  • The total number of commands that can be run in a single session is 250.
  • The command size is limited to 10KB.
  • If you establish a Live Response session and do not run any commands, the session times out in 30 minutes.
  • The idle session timeout is 15 minutes.
  • If the 100 concurrent session limit is reached, the TTL on a request to establish a new session is 60 seconds.
  • There are no file size restrictions. The system has been tested for file sizes up to 1GB. However, the file transfer capability depends on the speed of the network connection and session timeouts.

Considering these limitations, keep in mind that Live Response sessions, which use HTTPS, are not ideal for large file transfers.