> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/10-siem-edr-xdr/response-actions.md).

# Response Actions

Response actions let you act on a host directly from the console. They are sent to the EDR/XDR agent, which carries them out and reports the result. You typically launch them from an incident (see [Detections, alerts & incidents](/user-docs/10-siem-edr-xdr/detections-alerts-incidents.md)), but they apply to a specific endpoint.

## Available actions

### Isolate

Cuts the host off from the network so it can no longer communicate, while keeping the agent connected so you can continue to investigate and respond.

### Restore (un-isolate)

Reverses an isolation and returns the host to normal network connectivity.

### Collect Triage

Gathers a triage bundle from the host — host facts and process state — into a downloadable artifact for analysis.

### Collect Logs

Collects system logs from the host into a downloadable artifact.

### Collect File

Retrieves a specific file from the host by path and makes it available as a downloadable artifact.

### Quarantine File

Neutralises a file on the host by path so it can no longer be used.

### Restore File

Reverses a quarantine and restores the file.

### Kill Process

Terminates a specific process on the host by its process ID.

### Delete File

Removes a file from the host by path.

## How artifacts work

Collection actions (Triage, Logs, File) produce a downloadable artifact. Once the agent has uploaded it, you can download the artifact from the action's result in the console.

## Notes

* Response actions require the agent to be online and running with sufficient privileges on the host.
* Actions are recorded against the host (and the incident you launched them from) so there is an audit trail of what was done.
* **Block C2** — blocking a malicious destination is handled as a containment step in an automated response playbook (it pushes a block rule to a firewall integration), not as a per-host agent command. See [Detections, alerts & incidents](/user-docs/10-siem-edr-xdr/detections-alerts-incidents.md).