# Elastic defend (Automatic Response Action Isnt Working )

**URL:** <https://discuss.elastic.co/t/elastic-defend-automatic-response-action-isnt-working/390597>\
**Category:** Endpoint Security\
**Created:** [September 23, 2026, 6:45am UTC](https://discuss.elastic.co/t/elastic-defend-automatic-response-action-isnt-working/390597 "2026-09-23T06:45:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jatin3101](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@jatin3101](https://discuss.elastic.co/u/jatin3101)\
**Post date:** [September 23, 2026, 6:45am UTC](https://discuss.elastic.co/t/elastic-defend-automatic-response-action-isnt-working/390597/1 "2026-09-23T06:45:10Z")

</div>

> [@The response action does not work](https://discuss.elastic.co/t/the-response-action-does-not-work/385980):
>
> Good afternoon! Tell me, please. I have created a custom rule defining the creation of a local user account, configured it so that the isolation of the host is performed using a "response action", but nothing happens.

Hi ,

i came across this problem that my response action arent working & somehad the same issue but their was solved and i dont undertsand how

detection rule- firewall disabled  
issue- want to run a script for enabling the firewall profile  
(when we run the script through console with runscript --script="FW" it is working fine)

see if you can help ( also i dont see any documentation explictly saying the the agent.type should be endpoint so where did you got that from )

incase you can respond here this is my mail :jatinc892@gmail.com

it would be a great help

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/0/c09976a29c455d27b42957a36ea169a4c6dc2661.png)

(basic rule like when firewall profile is disabled )

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/477c3ccbd6798d4264498d84637364de9e476668.png)

(i want to run a script that enabled the profile)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/6/8650a7841c71061983d4ae458e0489e3b2ef5ee2.png)

this is the script

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6fda3958f10e99d9a7b203bc409fe93510602d0c.png)

the alert isnt showing any response action

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/8/682b4ebda8e4b089f1f622d7045d43ba4c244a89.png)

my agent type is filebeat ( also if this is truely the case that agent.type should be endpoint then please attach the documentation which is saying that exactly )

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [September 25, 2026, 9:17am UTC](https://discuss.elastic.co/t/elastic-defend-automatic-response-action-isnt-working/390597/2 "2026-09-25T09:17:29Z")

</div>

Hi @jatin3101

> i dont see any documentation explictly saying the the agent.type should be endpoint so where did you got that from

[Endpoint response actions](https://www.elastic.co/docs/solutions/security/endpoint-response-actions) are handled by Endpoint

You're technically sending down to Endpoint the same request as from the Response Console.

> the alert isnt showing any response action

I don't know if it should, but due to the above there's a second way to check if the action was executed - look it up in `Response actions history`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af298472192755afd94d3a2ee3fdf4fe51847dd3.jpeg)

You will see there all response actions, whether they were initiated from the Response Console or from automated hooks

> my agent type is filebeat

That's most likely the configuration problem.

PS. I'd recommend removing your email to avoid spam. This forum has private messages for that