If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
case_idsstring[] · min items: 1 · max items: 50
The IDs of cases where the action taken will be logged. Max of 50.
commentstring · max length: 30000
Optional comment
endpoint_idsstring[] · min items: 1 · max items: 250required
List of endpoint IDs (cannot contain empty strings). Max of 250.
An object containing the host names associated with the agent IDs the response action was sent to
<string>object · format: uuid
namestring
The host name
idstring · format: uuid
The response action ID
isCompleteboolean
Whether the response action is complete
isExpiredboolean
Whether the response action is expired
outputsmapstring to object
The outputs of the response action for each agent ID that it was sent to. Content different depending on the
response action command and will only be present for agents that have responded to the response action
<string>object · format: uuid
contentstring | objectrequired
The response action output content for the agent ID. Exact format depends on the response action command.
typeenumrequired
Values:jsontext
parametersobject
The parameters of the response action. Content different depending on the response action command