Get action details

Base URL: https://{kibana_url}

GET /api/endpoint/action/{action_id}

Get the details of a response action using the action ID.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Response

application/json

One of:

command: kill-process

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: get-file

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: execute

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: runscript

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: upload

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: scan

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: cancel

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: isolate

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: unisolate

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: suspend-process

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: running-processes

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: memory-dump

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object required: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful