Automated response actions
Automatically respond to events with endpoint response actions triggered by detection rules.
Add Elastic Defend's response actions to detection rules to automatically perform actions on an affected host when an event meets the rule's criteria. Use these actions to support your response to detected threats and suspicious events.
Requirements
- Automated response actions require an Enterprise subscription.
- Hosts must have Elastic Agent installed with the Elastic Defend integration.
- Your user role must have the ability to create detection rules and to perform specific response actions.
- You can only add automated response actions to custom query rules.
You can add automated response actions to a new or existing custom query rule.
-
Do one of the following:
- New rule: On the last step of custom query rule creation, go to the Response Actions section and select Elastic Defend.
- Existing rule: Edit the rule's settings, then go to the Actions tab. In the tab, select Elastic Defend under the Response Actions section.
-
Select an option in the Response action field:
- Isolate: Isolate the host, blocking communication with other hosts on the network.
- Kill process: Terminate a process on the host.
- Suspend process: Temporarily suspend a process on the host.
Important
Be aware that automatic host isolation can result in unintended consequences, such as disrupting legitimate user activities or blocking critical business processes.
-
For process actions, specify how to identify the process you want to terminate or suspend:
- Turn on the toggle to use the alert's process.pid value as the identifier.
- To use a different alert field value to identify the process, turn off the toggle and enter the Custom field name.
-
Enter a comment describing why you’re performing the action on the host (optional).
-
To finish adding the response action, click Create & enable rule (for a new rule) or Save changes (for existing rules).