Cancel a response action

Base URL
https://{kibana_url}
  • POST /api/endpoint/action/cancel
  • POST /s/{space_id}/api/endpoint/action/cancel
Auth

Cancel a running or pending response action (Applies only to some agent types).

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

agent_type enum

List of agent types to retrieve. Defaults to endpoint.

Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
alert_ids string[] · min items: 1 · max items: 50

If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.

case_ids string[] · min items: 1 · max items: 50

The IDs of cases where the action taken will be logged. Max of 50.

comment string · max length: 30000

Optional comment

endpoint_ids string[] · min items: 1 · max items: 250 required

List of endpoint IDs (cannot contain empty strings). Max of 250.

parameters object required

Parameters object

Response

Indicates a successful call.

application/json
Base URL
https://{kibana_url}