Skip to content

[REQUEST][8.19]: Enable endpoint actions in events #6868

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: 8.x
Choose a base branch
from
Open

[REQUEST][8.19]: Enable endpoint actions in events #6868

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
15977ad
First draft
nastasha-solomon Jun 2, 2025
9818991
docs for respond action
nastasha-solomon Jun 2, 2025
79b44fc
minor edit
nastasha-solomon Jun 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions docs/management/admin/host-isolation-ov.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,10 +41,11 @@ All actions executed on a host are tracked in the host’s response actions hist
[[isolate-a-host]]
== Isolate a host

.Isolate a host from a detection alert
.Isolate a host from an event or a detection alert
[%collapsible]
====
. Open a detection alert:
. Open an event or a detection alert:
* From the event analyzer view: Click an event.
* From the Alerts table or Timeline: Click *View details* (image:images/view-details-icon.png[View details icon,16,15]).
* From a case with an attached alert: Click *Show alert details* (*>*).
. Click *Take action -> Isolate host*.
Expand Down Expand Up @@ -98,10 +99,11 @@ image::images/host-isolated-notif.png[Host isolated notification message,350]
[[release-a-host]]
== Release a host

.Release a host from a detection alert
.Release a host from an event or a detection alert
[%collapsible]
====
. Open a detection alert:
. Open an event or detection alert:
* From the event analyzer view: Click an event.
* From the Alerts table or Timeline: Click *View details* (image:images/view-details-icon.png[View details icon,16,15]).
* From a case with an attached alert: Click *Show alert details* (*>*).
. From the alert details flyout, click *Take action -> Release host*.
Expand Down
2 changes: 1 addition & 1 deletion docs/management/admin/response-actions.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ Launch the response console from any of the following places in {elastic-sec}:

* *Endpoints* page -> *Actions* menu (*...*) -> *Respond*
* Endpoint details flyout -> *Take action* -> *Respond*
* Alert details flyout -> *Take action* -> *Respond*
* Alert or event details flyout -> *Take action* -> *Respond*
* Host details page → *Respond*

To perform an action on the endpoint, enter a <<response-action-commands,response action command>> in the input area at the bottom of the console, then press *Return*. Output from the action is displayed in the console.
Expand Down