Get action details

Base URL: https://{kibana_url}

GET /api/endpoint/action/{action_id}
GET /s/{space_id}/api/endpoint/action/{action_id}

Auth

Get the details of a response action using the action ID.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
action_id string · min length: 1 · max length: 256 required: The ID of the response action to retrieve.; Example: fr518850-681a-4y60-aa98-e22640cae2b8

Response

application/json

One of:

command: kill-process

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: get-file

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: execute

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: runscript

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: upload

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: scan

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: cancel

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: isolate

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: unisolate

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: suspend-process

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: running-processes

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful

command: memory-dump

command enum · min length: 1 required: The command for the response action; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agents string[] · format: uuid: The agent IDs for the hosts that the response action was sent to
agentState map string to object: The state of the response action for each agent ID that it was sent to
agentType enum: List of agent types to retrieve. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
completedAt string · format: date-time: The response action completion time
createdBy string: The user who created the response action
hosts map string to object: An object containing the host names associated with the agent IDs the response action was sent to
id string · format: uuid: The response action ID
isComplete boolean: Whether the response action is complete
isExpired boolean: Whether the response action is expired
outputs map string to object: The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action
parameters object required: The parameters of the response action. Content different depending on the response action command
startedAt string · format: date-time: The response action start time
status string: The response action status
wasCanceled boolean: Whether the response action was canceled
wasSuccessful boolean: Whether the response action was successful