Sign in

v53

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-076771,7565.2 MB
Security Endpoint Management API

Get response actions

Spaces method and path for this operation:

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action</span></div>

Refer to Spaces for more information.

Get a list of all response actions.

get/api/endpoint/action

Query parameters

pageinteger

Page number

Example:1

The page number to return.

pageSizeinteger

Number of items per page

Example:10

The number of response actions to return per page.

commandsSecurityEndpointManagementAPICommand[]

A list of response action command names.

A list of response action command names to filter by.

[
  "isolate",
  "unisolate"
]
string[]
OR
string

A list of Elastic Agent IDs to filter the response actions by.

string[]
OR
string

A list of user IDs that submitted the response actions.

startDatestring

A start date in ISO 8601 format or Date Math format.

Example:2023-10-31T00:00:00.000Z

A start date in ISO 8601 format or Date Math format (for example, now-24h).

endDatestring

An end date in ISO format or Date Math format.

Example:2023-10-31T23:59:59.999Z

An end date in ISO 8601 format or Date Math format (for example, now).

agentTypes'endpoint' | 'sentinel_one' | 'crowdstrike' | 'microsoft_defender_endpoint'

List of agent types to retrieve. Defaults to endpoint.

Example:endpoint

The agent type to filter response actions by. Defaults to endpoint.

string[]
OR
string

A list of response action IDs whose outputs should be included in the response.

typesSecurityEndpointManagementAPIType[]

List of types of response actions

A list of response action types to filter by (automated, manual).

[
  "automated",
  "manual"
]

Response

Indicates a successful call.

agentTypesstring[]

The list of agent types the query was filtered by.

commandsstring[]

The list of commands the query was filtered by.

elasticAgentIdsstring[]

The list of elastic agent IDs the query was filtered by.

endDatestring

The end date filter applied to the query.

pageinteger

The current page number.

pageSizeinteger

The number of items per page.

startDatestring

The start date filter applied to the query.

statusesstring[]

The list of statuses the query was filtered by.

totalinteger

The total number of response actions matching the query.

userIdsstring[]

The list of user IDs the query was filtered by.

Example response

{
  "data": [
    {
      "agents": [
        "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
      ],
      "agentType": "endpoint",
      "command": "running-processes",
      "completedAt": "2022-08-08T09:50:47.672Z",
      "createdBy": "elastic",
      "id": "b3d6de74-36b0-4fa8-be46-c375bf1771bf",
      "isCompleted": true,
      "isExpired": false,
      "startedAt": "2022-08-08T15:24:57.402Z",
      "wasSuccessful": true
    },
    {
      "agents": [
        "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
      ],
      "agentType": "endpoint",
      "command": "isolate",
      "completedAt": "2022-08-08T10:41:57.352Z",
      "createdBy": "elastic",
      "id": "43b4098b-8752-4fbb-a7a7-6df7c74d0ee3",
      "isCompleted": true,
      "isExpired": false,
      "startedAt": "2022-08-08T15:23:37.359Z",
      "wasSuccessful": true
    },
    {
      "agents": [
        "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
      ],
      "agentType": "endpoint",
      "command": "kill-process",
      "comment": "bad process - taking up too much cpu",
      "completedAt": "2022-08-08T09:44:50.952Z",
      "createdBy": "elastic",
      "id": "5bc92c86-b8e6-42dd-837f-12ad29e09caa",
      "isCompleted": true,
      "isExpired": false,
      "startedAt": "2022-08-08T14:38:44.125Z",
      "wasSuccessful": true
    },
    {
      "agents": [
        "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
      ],
      "agentType": "endpoint",
      "command": "unisolate",
      "comment": "Not a threat to the network",
      "completedAt": "2022-08-08T09:40:47.398Z",
      "createdBy": "elastic",
      "id": "790d54e0-3aa3-4e5b-8255-3ce9d851246a",
      "isCompleted": true,
      "isExpired": false,
      "startedAt": "2022-08-08T14:38:15.391Z",
      "wasSuccessful": true
    }
  ],
  "elasticAgentIds": [
    "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0"
  ],
  "endDate": "now",
  "page": 1,
  "pageSize": 10,
  "startDate": "now-24h/h",
  "total": 4
}