Run a script
Base URL
https://{kibana_url}
POST
/api/endpoint/action/run_script
POST
/s/{space_id} /api/endpoint/action/run_script
Auth
Run a script on a host. Currently supported only for some agent types.
Expand all
space_id
string optional
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
{
}
agent_type
enum
List of agent types to retrieve. Defaults to endpoint.
Values:
endpoint
sentinel_one
crowdstrike
microsoft_defender_endpoint
alert_ids
string [] · min items: 1 · max items: 50
If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
case_ids
string [] · min items: 1 · max items: 50
The IDs of cases where the action taken will be logged. Max of 50.
endpoint_ids
string [] · min items: 1 · max items: 250 required
List of endpoint IDs (cannot contain empty strings). Max of 250.
parameters
object required
Parameters object
200
Indicates a successful call.
application/json
data
object
+
Show 16 properties
agents
string [] · format: uuid
The agent IDs for the hosts that the response action was sent to
agentState
map string to object
The state of the response action for each agent ID that it was sent to
<string>
object · format: uuid
+
Show 4 properties
completedAt
string
The date and time the response action was completed for the agent ID
isCompleted
boolean
Whether the response action is completed for the agent ID
wasCanceled
boolean
Whether the response action was canceled for the agent ID
wasSuccessful
boolean
Whether the response action was successful for the agent ID
agentType
enum
List of agent types to retrieve. Defaults to endpoint.
Values:
endpoint
sentinel_one
crowdstrike
microsoft_defender_endpoint
command
enum · min length: 1 required
The command for the response action
Values:
isolate
unisolate
kill-process
suspend-process
running-processes
get-file
execute
upload
scan
runscript
cancel
memory-dump
completedAt
string · format: date-time
The response action completion time
createdBy
string
The user who created the response action
hosts
map string to object
An object containing the host names associated with the agent IDs the response action was sent to
<string>
object · format: uuid
+
Show 1 property
name
string
The host name
id
string · format: uuid
The response action ID
isComplete
boolean
Whether the response action is complete
isExpired
boolean
Whether the response action is expired
outputs
map string to object
The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
<string>
object · format: uuid
+
Show 2 properties
content
string | object required
The response action output content for the agent ID. Exact format depends on the response action command.
type
enum required
Values:
json
text
parameters
object
The parameters of the response action. Content different depending on the response action command
startedAt
string · format: date-time
The response action start time
status
string
The response action status
wasCanceled
boolean
Whether the response action was canceled
wasSuccessful
boolean
Whether the response action was successful
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Run a script against an Elastic Defend agent
languages
Run a script against a Microsoft Defender Endpoint agent
languages
Run a script against a SentinelOne agent
languages
Request
Console
1 / 2 languages
‹
›
Endpoint runscript to collect logs
Show more
1
2
3
4
5
6
7
8
9
10
11
POST kbn:/api/endpoint/action/run_script
{
"agent_type": "endpoint",
"endpoint_ids": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"parameters": {
"scriptId": "1111-2222-3333-4444-5555-6666-7777-8888",
"scriptInput": "--path= /usr/log/exec.log"
}
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
10
11
12
13
curl -X POST "${KIBANA_URL}/api/endpoint/action/run_script" \
-H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"agent_type": "endpoint",
"endpoint_ids": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"parameters": {
"scriptId": "1111-2222-3333-4444-5555-6666-7777-8888",
"scriptInput": "--path= /usr/log/exec.log"
}
}'
Generated from the API spec
Response
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
"data": {
"agents": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"agentState": {
"ed518850-681a-4d60-bb98-e22640cae2a8": {
"isCompleted": false,
"wasSuccessful": false
}
},
"agentType": "sentinel_one",
"command": "runscript",
"createdBy": "elastic",
"hosts": {
"ed518850-681a-4d60-bb98-e22640cae2a8": {
"name": "gke-node-1235412"
}
},
"id": "233db9ea-6733-4849-9226-5a7039c7161d",
"isCompleted": false,
"isExpired": false,
"outputs": {},
"parameters": {
"scriptId": "1111-2222-3333-4444-5555-6666-7777-8888"
},
"startedAt": "2022-07-29T19:08:49.126Z",
"status": "pending",
"wasSuccessful": false
}
}
Request
Console
1 / 2 languages
‹
›
Microsoft Defender Endpoint runscript
Show more
1
2
3
4
5
6
7
8
9
10
11
POST kbn:/api/endpoint/action/run_script
{
"agent_type": "microsoft_defender_endpoint",
"endpoint_ids": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"parameters": {
"args": "-param1 value1 -param2 value2",
"scriptName": "my-script.ps1"
}
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
10
11
12
13
curl -X POST "${KIBANA_URL}/api/endpoint/action/run_script" \
-H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"agent_type": "microsoft_defender_endpoint",
"endpoint_ids": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"parameters": {
"args": "-param1 value1 -param2 value2",
"scriptName": "my-script.ps1"
}
}'
Generated from the API spec
Response
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
"data": {
"agents": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"agentState": {
"ed518850-681a-4d60-bb98-e22640cae2a8": {
"isCompleted": false,
"wasSuccessful": false
}
},
"agentType": "sentinel_one",
"command": "runscript",
"createdBy": "elastic",
"hosts": {
"ed518850-681a-4d60-bb98-e22640cae2a8": {
"name": "gke-node-1235412"
}
},
"id": "233db9ea-6733-4849-9226-5a7039c7161d",
"isCompleted": false,
"isExpired": false,
"outputs": {},
"parameters": {
"scriptId": "1111-2222-3333-4444-5555-6666-7777-8888"
},
"startedAt": "2022-07-29T19:08:49.126Z",
"status": "pending",
"wasSuccessful": false
}
}
Request
Console
1 / 2 languages
‹
›
1
2
3
4
5
6
7
8
9
10
11
POST kbn:/api/endpoint/action/run_script
{
"agent_type": "sentinel_one",
"endpoint_ids": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"parameters": {
"scriptId": "1111-2222-3333-4444-5555-6666-7777-8888",
"scriptInput": "--delete --paths-to-delete /tmp/temp_file.txt,/tmp/random_file.txt"
}
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
10
11
12
13
curl -X POST "${KIBANA_URL}/api/endpoint/action/run_script" \
-H "Authorization: ApiKey ${API_KEY}" \
-H "Content-Type: application/json" \
-d '{
"agent_type": "sentinel_one",
"endpoint_ids": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"parameters": {
"scriptId": "1111-2222-3333-4444-5555-6666-7777-8888",
"scriptInput": "--delete --paths-to-delete /tmp/temp_file.txt,/tmp/random_file.txt"
}
}'
Generated from the API spec
Response
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
"data": {
"agents": [
"ed518850-681a-4d60-bb98-e22640cae2a8"
],
"agentState": {
"ed518850-681a-4d60-bb98-e22640cae2a8": {
"isCompleted": false,
"wasSuccessful": false
}
},
"agentType": "sentinel_one",
"command": "runscript",
"createdBy": "elastic",
"hosts": {
"ed518850-681a-4d60-bb98-e22640cae2a8": {
"name": "gke-node-1235412"
}
},
"id": "233db9ea-6733-4849-9226-5a7039c7161d",
"isCompleted": false,
"isExpired": false,
"outputs": {},
"parameters": {
"scriptId": "1111-2222-3333-4444-5555-6666-7777-8888"
},
"startedAt": "2022-07-29T19:08:49.126Z",
"status": "pending",
"wasSuccessful": false
}
}