Security endpoint management

Interact with and manage endpoints running the Elastic Defend integration.

Get response actions
- GET /api/endpoint/action
Cancel a response action
- POST /api/endpoint/action/cancel
Run a command
- POST /api/endpoint/action/execute
Get a file
- POST /api/endpoint/action/get_file
Isolate an endpoint
- POST /api/endpoint/action/isolate
Terminate a process
- POST /api/endpoint/action/kill_process
Generate a memory dump from the host machine
- POST /api/endpoint/action/memory_dump
Run a script
- POST /api/endpoint/action/run_script
Get running processes
- POST /api/endpoint/action/running_procs
Scan a file or directory
- POST /api/endpoint/action/scan
Get actions state
- GET /api/endpoint/action/state
Suspend a process
- POST /api/endpoint/action/suspend_process
Release an isolated endpoint
- POST /api/endpoint/action/unisolate
Upload a file
- POST /api/endpoint/action/upload
Get action details
- GET /api/endpoint/action/{action_id}
Get file information
- GET /api/endpoint/action/{action_id}/file/{file_id}
Download a file
- GET /api/endpoint/action/{action_id}/file/{file_id}/download
Get response actions status
- GET /api/endpoint/action_status
Get a metadata list
- GET /api/endpoint/metadata
Get metadata
- GET /api/endpoint/metadata/{id}
Get a policy response
- GET /api/endpoint/policy_response
Get a protection updates note
- GET /api/endpoint/protection_updates_note/{package_policy_id}
Create or update a protection updates note
- POST /api/endpoint/protection_updates_note/{package_policy_id}
Get a list of scripts
- GET /api/endpoint/scripts_library
Create script
- POST /api/endpoint/scripts_library
Get script
- GET /api/endpoint/scripts_library/{script_id}
Update script
- PATCH /api/endpoint/scripts_library/{script_id}
Delete a script
- DELETE /api/endpoint/scripts_library/{script_id}
Download a script file
- GET /api/endpoint/scripts_library/{script_id}/download