Get response actions

Base URL
https://{kibana_url}
  • GET /api/endpoint/action
  • GET /s/{space_id}/api/endpoint/action
Auth

Get a list of all response actions.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

page integer · min: 1 · default: 1
pageSize integer · min: 1 · max: 100 · default: 10
commands enum[]
Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan
agentIds union string[] | string · min length: 1
Example: ["agent-id-1","agent-id-2"]
userIds union string[] | string
Example: ["user-id-1","user-id-2"]
startDate string
Example: 2023-10-31T00:00:00.000Z
endDate string
Example: 2023-10-31T23:59:59.999Z
agentTypes enum
Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
withOutputs union string[] | string
Example: ["action-id-1","action-id-2"]
types enum[] · min length: 1 · max length: 2
Values: automated manual

Response

OK

application/json

Response Type: object

Base URL
https://{kibana_url}