Get response actions
- Base URL
-
https://{kibana_url}
- GET /api/endpoint/action
- GET /s/{space_id}/api/endpoint/action
Refer to Spaces for more information.
Get a list of all response actions.
Query parameters
-
pageSizeinteger · min: 1 · max: 100 · default: 10 -
The number of response actions to return per page.
-
commandsenum · max items: 50 -
A list of response action command names to filter by.
-
Values:
isolateunisolatekill-processsuspend-processrunning-processesget-fileexecuteuploadscanrunscriptcancelmemory-dump -
agentIdsoneOf · min length: 1 -
A list of Elastic Agent IDs to filter the response actions by.
-
Example:
["agent-id-1","agent-id-2"] -
userIdsoneOf -
A list of user IDs that submitted the response actions.
-
Example:
["user-id-1","user-id-2"] -
startDatestring · max length: 64 -
A start date in ISO 8601 format or Date Math format (for example,
now-24h). -
Example:
2023-10-31T00:00:00.000Z -
endDatestring · max length: 64 -
An end date in ISO 8601 format or Date Math format (for example,
now). -
Example:
2023-10-31T23:59:59.999Z -
agentTypes -
The agent type to filter response actions by. Defaults to
endpoint. -
Values:
endpointsentinel_onecrowdstrikemicrosoft_defender_endpoint
Response
Indicates a successful call.
-
dataobject -
The list of response actions.
-
agentStatemap string to object -
The state of the response action for each agent ID that it was sent to
-
<string>object · format: uuid -
agentType -
List of agent types to retrieve. Defaults to
endpoint. -
Values:
endpointsentinel_onecrowdstrikemicrosoft_defender_endpoint -
command· min length: 1required -
The command for the response action
-
Values:
isolateunisolatekill-processsuspend-processrunning-processesget-fileexecuteuploadscanrunscriptcancelmemory-dump -
hostsmap string to object -
An object containing the host names associated with the agent IDs the response action was sent to
-
outputsmap string to object -
The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action