Hi ,
i came across this problem that my response action arent working & somehad the same issue but their was solved and i dont undertsand how
detection rule- firewall disabled
issue- want to run a script for enabling the firewall profile
(when we run the script through console with runscript --script="FW" it is working fine)
see if you can help ( also i dont see any documentation explictly saying the the agent.type should be endpoint so where did you got that from )
incase you can respond here this is my mail :jatinc892@gmail.com
it would be a great help
(basic rule like when firewall profile is disabled )
(i want to run a script that enabled the profile)
this is the script
the alert isnt showing any response action
my agent type is filebeat ( also if this is truely the case that agent.type should be endpoint then please attach the documentation which is saying that exactly )