# Alert actions - how to kill process?

**URL:** <https://discuss.elastic.co/t/alert-actions-how-to-kill-process/323366>\
**Category:** Elastic Security\
**Tags:** elastic-stack-alerting, language-clients\
**Created:** [January 17, 2023, 9:30pm UTC](https://discuss.elastic.co/t/alert-actions-how-to-kill-process/323366 "2023-01-17T21:30:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yak990](https://avatars.discourse-cdn.com/v4/letter/y/c68b51/32.png) [@yak990](https://discuss.elastic.co/u/yak990)\
**Post date:** [January 17, 2023, 9:30pm UTC](https://discuss.elastic.co/t/alert-actions-how-to-kill-process/323366/1 "2023-01-17T21:30:28Z")

</div>

Several of these alert rules are severe enough that I would want to kill the process that generated the alert. Suspicious .NET Reflection via PowerShell would be an example. It would be nice to be able to kill the process or process trees right then. Is this possible? Right now it seems like all it can do is send a email or alert through another service.

---

<div class="post-metadata">

**Author:** ![caitlinbetz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/caitlinbetz/32/74246_2.png) [@caitlinbetz](https://discuss.elastic.co/u/caitlinbetz)\
**Post date:** [January 18, 2023, 2:30pm UTC](https://discuss.elastic.co/t/alert-actions-how-to-kill-process/323366/2 "2023-01-18T14:30:15Z")

</div>

Hi @yak990 - thanks for using Elastic Security! What you are looking for unfortunately is not currently available in elastic security - however, your request is well-aligned with capabilities that we are actively working to bring to the security solution. While I can't provide timing specifics - please keep an eye out!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 15, 2023, 2:30pm UTC](https://discuss.elastic.co/t/alert-actions-how-to-kill-process/323366/3 "2023-02-15T14:30:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
