Automated response actions

Add Elastic Defend's response actions to detection rules to automatically perform actions on an affected host when an event meets the rule’s criteria. Use these actions to support your response to detected threats and suspicious events.

Requirements

Automated response actions require the appropriate subscription in Elastic Stack or project feature tier in Serverless.
Hosts must have Elastic Agent installed with the Elastic Defend integration.
Your user role must have the ability to create detection rules and the privilege to perform specific response actions (for example, the Host Isolation privilege to isolate hosts).

To add automated response actions to a new or existing rule:

Do one of the following:
- New rule: On the last step of rule creation, go to the Response Actions section and select Elastic Defend.
- Existing rule: Edit the rule’s settings, then go to the Actions tab. In the tab, select Elastic Defend under the Response Actions section.
Select an option in the Response action field:
- Isolate: Isolate the host, blocking communication with other hosts on the network.
  
  Important
  
  Be aware that automatic host isolation can result in unintended consequences, such as disrupting legitimate user activities or blocking critical business processes.
- Kill process: Terminate a process on the host.
- Suspend process: Temporarily suspend a process on the host.
- The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Run script: Run a script on the host.
For process actions, specify how to identify the process you want to terminate or suspend:
- Turn on the toggle to use the alert’s process.pid value as the identifier.
- To use a different alert field value to identify the process, turn off the toggle and enter the Custom field name.
Enter a comment describing why you’re performing the action on the host (optional).
To finish adding the response action, click Create & enable rule (for a new rule) or Save changes (for existing rules).