Get response actions

Base URL
https://{kibana_url}
  • GET /api/endpoint/action
Auth

Get a list of all response actions.

Query parameters

page integer · min: 1 · default: 1

The page number to return.

pageSize integer · min: 1 · max: 100 · default: 10

The number of response actions to return per page.

commands enum[] · max items: 50

A list of response action command names to filter by.

Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agentIds union string[] | string · min length: 1

A list of Elastic Agent IDs to filter the response actions by.

Example: ["agent-id-1","agent-id-2"]
userIds union string[] | string

A list of user IDs that submitted the response actions.

Example: ["user-id-1","user-id-2"]
startDate string · max length: 64

A start date in ISO 8601 format or Date Math format (for example, now-24h).

Example: 2023-10-31T00:00:00.000Z
endDate string · max length: 64

An end date in ISO 8601 format or Date Math format (for example, now).

Example: 2023-10-31T23:59:59.999Z
agentTypes enum

The agent type to filter response actions by. Defaults to endpoint.

Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
withOutputs union string[] | string

A list of response action IDs whose outputs should be included in the response.

Example: ["action-id-1","action-id-2"]
types enum[] · min length: 1 · max length: 2

A list of response action types to filter by (automated, manual).

Values: automated manual

Response

Indicates a successful call.

application/json
agentTypes string[]

The list of agent types the query was filtered by.

commands string[]

The list of commands the query was filtered by.

data object[]

The list of response actions.

agents string[] · format: uuid

The agent IDs for the hosts that the response action was sent to

agentState map string to object

The state of the response action for each agent ID that it was sent to

<string> object · format: uuid
completedAt string

The date and time the response action was completed for the agent ID

isCompleted boolean

Whether the response action is completed for the agent ID

wasCanceled boolean

Whether the response action was canceled for the agent ID

wasSuccessful boolean

Whether the response action was successful for the agent ID

agentType enum

List of agent types to retrieve. Defaults to endpoint.

Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
command enum · min length: 1 required

The command for the response action

Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
completedAt string · format: date-time

The response action completion time

createdBy string

The user who created the response action

hosts map string to object

An object containing the host names associated with the agent IDs the response action was sent to

<string> object · format: uuid
name string

The host name

id string · format: uuid

The response action ID

isComplete boolean

Whether the response action is complete

isExpired boolean

Whether the response action is expired

outputs map string to object

The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action

<string> object · format: uuid
content string | object required

The response action output content for the agent ID. Exact format depends on the response action command.

type enum required
Values: json text
parameters object

The parameters of the response action. Content different depending on the response action command

startedAt string · format: date-time

The response action start time

status string

The response action status

wasCanceled boolean

Whether the response action was canceled

wasSuccessful boolean

Whether the response action was successful

elasticAgentIds string[]

The list of elastic agent IDs the query was filtered by.

endDate string

The end date filter applied to the query.

page integer

The current page number.

pageSize integer

The number of items per page.

startDate string

The start date filter applied to the query.

statuses string[]

The list of statuses the query was filtered by.

total integer

The total number of response actions matching the query.

userIds string[]

The list of user IDs the query was filtered by.

Base URL
https://{kibana_url}