Cancel a response action
- Base URL
-
https://{kibana_url}
- POST /api/endpoint/action/cancel
- POST /s/{space_id}/api/endpoint/action/cancel
Refer to Spaces for more information.
Cancel a running or pending response action (Applies only to some agent types).
Request body
-
agent_type -
List of agent types to retrieve. Defaults to
endpoint. -
Values:
endpointsentinel_onecrowdstrikemicrosoft_defender_endpoint -
alert_idsstring · min items: 1 · max items: 50 -
If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
-
case_idsstring · min items: 1 · max items: 50 -
The IDs of cases where the action taken will be logged. Max of 50.
Response
Indicates a successful call.
-
dataobject -
agentStatemap string to object -
The state of the response action for each agent ID that it was sent to
-
<string>object · format: uuid -
agentType -
List of agent types to retrieve. Defaults to
endpoint. -
Values:
endpointsentinel_onecrowdstrikemicrosoft_defender_endpoint -
command· min length: 1required -
The command for the response action
-
Values:
isolateunisolatekill-processsuspend-processrunning-processesget-fileexecuteuploadscanrunscriptcancelmemory-dump -
hostsmap string to object -
An object containing the host names associated with the agent IDs the response action was sent to
-
outputsmap string to object -
The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action