Response Actions

Response actions let you act on a host directly from the console. They are sent to the EDR/XDR agent, which carries them out and reports the result. You typically launch them from an incident (see Detections, alerts & incidents), but they apply to a specific endpoint.

Available actions

Isolate

Cuts the host off from the network so it can no longer communicate, while keeping the agent connected so you can continue to investigate and respond.

Restore (un-isolate)

Reverses an isolation and returns the host to normal network connectivity.

Collect Triage

Gathers a triage bundle from the host — host facts and process state — into a downloadable artifact for analysis.

Collect Logs

Collects system logs from the host into a downloadable artifact.

Collect File

Retrieves a specific file from the host by path and makes it available as a downloadable artifact.

Quarantine File

Neutralises a file on the host by path so it can no longer be used.

Restore File

Reverses a quarantine and restores the file.

Kill Process

Terminates a specific process on the host by its process ID.

Delete File

Removes a file from the host by path.

How artifacts work

Collection actions (Triage, Logs, File) produce a downloadable artifact. Once the agent has uploaded it, you can download the artifact from the action's result in the console.

Notes

• Response actions require the agent to be online and running with sufficient privileges on the host.

• Actions are recorded against the host (and the incident you launched them from) so there is an audit trail of what was done.

• Block C2 — blocking a malicious destination is handled as a containment step in an automated response playbook (it pushes a block rule to a firewall integration), not as a per-host agent command. See Detections, alerts & incidents.