Run a command

Base URL
https://{kibana_url}
  • POST /api/endpoint/action/execute
Auth

Run a shell command on an endpoint.

Request body

agent_type enum

List of agent types to retrieve. Defaults to endpoint.

Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
alert_ids string[] · min items: 1 · max items: 50

If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.

case_ids string[] · min items: 1 · max items: 50

The IDs of cases where the action taken will be logged. Max of 50.

comment string · max length: 30000

Optional comment

endpoint_ids string[] · min items: 1 · max items: 250 required

List of endpoint IDs (cannot contain empty strings). Max of 250.

parameters object required

Parameters object

Response

Indicates a successful call.

application/json
data object
agents string[] · format: uuid

The agent IDs for the hosts that the response action was sent to

agentState map string to object

The state of the response action for each agent ID that it was sent to

<string> object · format: uuid
completedAt string

The date and time the response action was completed for the agent ID

isCompleted boolean

Whether the response action is completed for the agent ID

wasCanceled boolean

Whether the response action was canceled for the agent ID

wasSuccessful boolean

Whether the response action was successful for the agent ID

agentType enum

List of agent types to retrieve. Defaults to endpoint.

Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
command enum · min length: 1 required

The command for the response action

Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
completedAt string · format: date-time

The response action completion time

createdBy string

The user who created the response action

hosts map string to object

An object containing the host names associated with the agent IDs the response action was sent to

<string> object · format: uuid
name string

The host name

id string · format: uuid

The response action ID

isComplete boolean

Whether the response action is complete

isExpired boolean

Whether the response action is expired

outputs map string to object

The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action

<string> object · format: uuid
content string | object required

The response action output content for the agent ID. Exact format depends on the response action command.

type enum required
Values: json text
parameters object

The parameters of the response action. Content different depending on the response action command

startedAt string · format: date-time

The response action start time

status string

The response action status

wasCanceled boolean

Whether the response action was canceled

wasSuccessful boolean

Whether the response action was successful

Base URL
https://{kibana_url}