stack kb security-endpoint-management-api endpoint-get-actions-list cli command

elastic stack kb security-endpoint-management-api endpoint-get-actions-list \
  [options]

Get response actions

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--page number

The page number to return.

--page-size number

The number of response actions to return per page.

--commands string[]

A list of response action command names to filter by.

Repeatable: pass --commands multiple times to supply more than one value

--agent-ids string

A list of Elastic Agent IDs to filter the response actions by.

Repeatable: pass --agent-ids multiple times to supply more than one value

--user-ids string

A list of user IDs that submitted the response actions.

Repeatable: pass --user-ids multiple times to supply more than one value

--start-date string

A start date in ISO 8601 format or Date Math format (for example, now-24h).

--end-date string

An end date in ISO 8601 format or Date Math format (for example, now).

--agent-types enum

The agent type to filter response actions by. Defaults to endpoint.

Values: endpoint, sentinel_one, crowdstrike, microsoft_defender_endpoint

--with-outputs string

A list of response action IDs whose outputs should be included in the response.

Repeatable: pass --with-outputs multiple times to supply more than one value

--types string[]

A list of response action types to filter by (automated, manual).

Repeatable: pass --types multiple times to supply more than one value

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON