Run a command

Base URL
https://{kibana_url}
  • POST /api/endpoint/action/execute
  • POST /s/{space_id}/api/endpoint/action/execute
Auth

Run a shell command on an endpoint.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

agent_type enum

List of agent types to retrieve. Defaults to endpoint.

Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
alert_ids string[] · format: nonempty · min items: 1

A list of alerts ids.

case_ids string[] · min items: 1

Case IDs to be updated (cannot contain empty strings)

comment string

Optional comment

endpoint_ids string[] · min items: 1 required

List of endpoint IDs (cannot contain empty strings)

parameters object required

Optional parameters object

Response

OK

application/json

Response Type: object

Base URL
https://{kibana_url}