Get response actions

Base URL: https://{kibana_url}

GET /api/endpoint/action

Auth

Get a list of all response actions.

Query parameters

page integer · min: 1 · default: 1: The page number to return.
pageSize integer · min: 1 · max: 100 · default: 10: The number of response actions to return per page.
commands enum[] · max items: 50: A list of response action command names to filter by.; Values: isolate unisolate kill-process suspend-process running-processes get-file execute upload scan runscript cancel memory-dump
agentIds union string[] | string · min length: 1: A list of Elastic Agent IDs to filter the response actions by.; Example: ["agent-id-1","agent-id-2"]
userIds union string[] | string: A list of user IDs that submitted the response actions.; Example: ["user-id-1","user-id-2"]
startDate string · max length: 64: A start date in ISO 8601 format or Date Math format (for example, now-24h).; Example: 2023-10-31T00:00:00.000Z
endDate string · max length: 64: An end date in ISO 8601 format or Date Math format (for example, now).; Example: 2023-10-31T23:59:59.999Z
agentTypes enum: The agent type to filter response actions by. Defaults to endpoint.; Values: endpoint sentinel_one crowdstrike microsoft_defender_endpoint
withOutputs union string[] | string: A list of response action IDs whose outputs should be included in the response.; Example: ["action-id-1","action-id-2"]
types enum[] · min length: 1 · max length: 2: A list of response action types to filter by (automated, manual).; Values: automated manual

Response

Indicates a successful call.

application/json

agentTypes string[]: The list of agent types the query was filtered by.
commands string[]: The list of commands the query was filtered by.
data object[]: The list of response actions.
elasticAgentIds string[]: The list of elastic agent IDs the query was filtered by.
endDate string: The end date filter applied to the query.
page integer: The current page number.
pageSize integer: The number of items per page.
startDate string: The start date filter applied to the query.
statuses string[]: The list of statuses the query was filtered by.
total integer: The total number of response actions matching the query.
userIds string[]: The list of user IDs the query was filtered by.