Response Actions
Last updated
Response actions let you act on a host directly from the console. They are sent to the EDR/XDR agent, which carries them out and reports the result. You typically launch them from an incident (see Detections, alerts & incidents), but they apply to a specific endpoint.
Cuts the host off from the network so it can no longer communicate, while keeping the agent connected so you can continue to investigate and respond.
Reverses an isolation and returns the host to normal network connectivity.
Gathers a triage bundle from the host — host facts and process state — into a downloadable artifact for analysis.
Collects system logs from the host into a downloadable artifact.
Retrieves a specific file from the host by path and makes it available as a downloadable artifact.
Neutralises a file on the host by path so it can no longer be used.
Reverses a quarantine and restores the file.
Terminates a specific process on the host by its process ID.
Removes a file from the host by path.
Collection actions (Triage, Logs, File) produce a downloadable artifact. Once the agent has uploaded it, you can download the artifact from the action's result in the console.
Response actions require the agent to be online and running with sufficient privileges on the host.
Actions are recorded against the host (and the incident you launched them from) so there is an audit trail of what was done.
Block C2 — blocking a malicious destination is handled as a containment step in an automated response playbook (it pushes a block rule to a firewall integration), not as a per-host agent command. See Detections, alerts & incidents.
Last updated