Third-party response actions

You can perform response actions on hosts enrolled in other third-party endpoint protection systems, such as CrowdStrike or SentinelOne. For example, you can direct the other system to isolate a suspicious endpoint from your network, without leaving the Elastic Security UI.

Requirements

Third-party response actions require the appropriate subscription in Elastic Stack or project feature tier in Serverless.
Each response action type has its own user role privilege requirements. Find an action’s role requirements at Endpoint response actions.
Additional configuration is required to connect Elastic Security with a third-party system.

CrowdStrike response actions

These response actions are supported for CrowdStrike-enrolled hosts:

Isolate and release a host using any of these methods:
- From a detection alert
- From the response console
Refer to the instructions on isolating and releasing hosts for more details.
Run a script on a host with the runscript response action.
View past response action activity in the response actions history log.

Microsoft Defender for Endpoint response actions

These response actions are supported for Microsoft Defender for Endpoint–enrolled hosts:

Isolate and release a host using any of these methods:
- From a detection alert
- From the response console
Refer to the instructions on isolating and releasing hosts for more details.
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.1 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Run a script on a host with the runscript response action.
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Cancel an ongoing action on a host with the cancel response action.

SentinelOne response actions

These response actions are supported for SentinelOne-enrolled hosts:

Isolate and release a host using any of these methods:
- From a detection alert
- From the response console
Refer to the instructions on isolating and releasing hosts for more details.
Retrieve a file from a host with the get-file response action.

Note

For SentinelOne-enrolled hosts, you must use the password Elastic@123 to open the retrieved file.
Get a list of processes running on a host with the processes response action. For SentinelOne-enrolled hosts, this command returns a link for downloading the process list in a file.
Terminate a process running on a host with the kill-process response action.

Note

For SentinelOne-enrolled hosts, you must use the parameter --processName to identify the process to terminate. --pid and --entityId are not supported.

Example: kill-process --processName cat --comment "Terminate suspicious process"
View past response action activity in the response actions history log.
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Run a script on a host with the runscript response action.