Security endpoint management
Interact with and manage endpoints running the Elastic Defend integration.
29 endpoints
-
Get response actions
- GET /api/endpoint/action
-
Get response actions status
- GET /api/endpoint/action_status
-
Get action details
- GET /api/endpoint/action/{action_id}
-
Get file information
- GET /api/endpoint/action/{action_id}/file/{file_id}
-
Download a file
- GET /api/endpoint/action/{action_id}/file/{file_id}/download
-
Cancel a response action
- POST /api/endpoint/action/cancel
-
Run a command
- POST /api/endpoint/action/execute
-
Get a file
- POST /api/endpoint/action/get_file
-
Isolate an endpoint
- POST /api/endpoint/action/isolate
-
Terminate a process
- POST /api/endpoint/action/kill_process
-
Generate a memory dump from the host machine
- POST /api/endpoint/action/memory_dump
-
Run a script
- POST /api/endpoint/action/run_script
-
Get running processes
- POST /api/endpoint/action/running_procs
-
Scan a file or directory
- POST /api/endpoint/action/scan
-
Get actions state
- GET /api/endpoint/action/state
-
Suspend a process
- POST /api/endpoint/action/suspend_process
-
Release an isolated endpoint
- POST /api/endpoint/action/unisolate
-
Upload a file
- POST /api/endpoint/action/upload
-
Get a metadata list
- GET /api/endpoint/metadata
-
Get metadata
- GET /api/endpoint/metadata/{id}
-
Get a policy response
- GET /api/endpoint/policy_response
-
Get a protection updates note
- GET /api/endpoint/protection_updates_note/{package_policy_id}
-
Create or update a protection updates note
- POST /api/endpoint/protection_updates_note/{package_policy_id}
-
Get a list of scripts
- GET /api/endpoint/scripts_library
-
Create script
- POST /api/endpoint/scripts_library
-
Delete a script
- DELETE /api/endpoint/scripts_library/{script_id}
-
Get script
- GET /api/endpoint/scripts_library/{script_id}
-
Update script
- PATCH /api/endpoint/scripts_library/{script_id}
-
Download a script file
- GET /api/endpoint/scripts_library/{script_id}/download