Get response actions

Base URL
https://{kibana_url}
  • GET /api/endpoint/action
Auth

Get a list of all response actions.

Query parameters

page integer · min: 1 · default: 1

The page number to return.

pageSize integer · min: 1 · max: 100 · default: 10

The number of response actions to return per page.

commands enum[] · max items: 50

A list of response action command names to filter by.

Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agentIds union string[] | string · min length: 1

A list of Elastic Agent IDs to filter the response actions by.

Example: ["agent-id-1","agent-id-2"]
userIds union string[] | string

A list of user IDs that submitted the response actions.

Example: ["user-id-1","user-id-2"]
startDate string · max length: 64

A start date in ISO 8601 format or Date Math format (for example, now-24h).

Example: 2023-10-31T00:00:00.000Z
endDate string · max length: 64

An end date in ISO 8601 format or Date Math format (for example, now).

Example: 2023-10-31T23:59:59.999Z
agentTypes enum

The agent type to filter response actions by. Defaults to endpoint.

Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
withOutputs union string[] | string

A list of response action IDs whose outputs should be included in the response.

Example: ["action-id-1","action-id-2"]
types enum[] · min length: 1 · max length: 2

A list of response action types to filter by (automated, manual).

Values: automated manual

Response

Indicates a successful call.

application/json
agentTypes string[]

The list of agent types the query was filtered by.

commands string[]

The list of commands the query was filtered by.

elasticAgentIds string[]

The list of elastic agent IDs the query was filtered by.

endDate string

The end date filter applied to the query.

page integer

The current page number.

pageSize integer

The number of items per page.

startDate string

The start date filter applied to the query.

statuses string[]

The list of statuses the query was filtered by.

total integer

The total number of response actions matching the query.

userIds string[]

The list of user IDs the query was filtered by.

Base URL
https://{kibana_url}