Elastic defend (Automatic Response Action Isnt Working )

[jatin3101]

The response action does not work

Good afternoon! Tell me, please. I have created a custom rule defining the creation of a local user account, configured it so that the isolation of the host is performed using a "response action", but nothing happens. [image] [image] [image] [image]

Hi ,

i came across this problem that my response action arent working & somehad the same issue but their was solved and i dont undertsand how

detection rule- firewall disabled
issue- want to run a script for enabling the firewall profile
(when we run the script through console with runscript --script="FW" it is working fine)

see if you can help ( also i dont see any documentation explictly saying the the agent.type should be endpoint so where did you got that from )

incase you can respond here this is my mail :jatinc892@gmail.com

it would be a great help

(basic rule like when firewall profile is disabled )

(i want to run a script that enabled the profile)

this is the script

the alert isnt showing any response action

my agent type is filebeat ( also if this is truely the case that agent.type should be endpoint then please attach the documentation which is saying that exactly )

[lesio (Leszek Kubik)]

Hi @jatin3101

i dont see any documentation explictly saying the the agent.type should be endpoint so where did you got that from

Endpoint response actions are handled by Endpoint

You're technically sending down to Endpoint the same request as from the Response Console.

the alert isnt showing any response action

I don't know if it should, but due to the above there's a second way to check if the action was executed - look it up in Response actions history

You will see there all response actions, whether they were initiated from the Response Console or from automated hooks

my agent type is filebeat

That's most likely the configuration problem.

PS. I'd recommend removing your email to avoid spam. This forum has private messages for that