# Response Action

**URL:** <https://discuss.elastic.co/t/response-action/354614>\
**Category:** Elastic Security\
**Created:** [March 4, 2024, 5:50am UTC](https://discuss.elastic.co/t/response-action/354614 "2024-03-04T05:50:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohd\_sa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohd_sa/32/124547_2.png) [@mohd\_sa](https://discuss.elastic.co/u/mohd_sa)\
**Post date:** [March 4, 2024, 5:50am UTC](https://discuss.elastic.co/t/response-action/354614/1 "2024-03-04T05:50:41Z")

</div>

Hi  
when I send action query for example "processes" on response tab, i recieve this error "response action signature verification failed with error: signature could not be verified"

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [March 4, 2024, 1:54pm UTC](https://discuss.elastic.co/t/response-action/354614/2 "2024-03-04T13:54:19Z")

</div>

There's very little details in this description so we have to consider an issue on Endpoint side or at stack side. I'd suggest to verify the signing (stack side) first. Could you modify Elastic Defend policy, change anything, un-check some event collection for example, and wait for it to be applied on that Endpoint. If it applies without issues then we're having a response action specific issue. Otherwise it'd suggest that signing at the stack side has changed.

In any case changing log level to Debug, repeating the experiment (change of policy, executing the action), and collecting diagnostics zip will help us to see more.

---

<div class="post-metadata">

**Author:** ![mohd\_sa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohd_sa/32/124547_2.png) [@mohd\_sa](https://discuss.elastic.co/u/mohd_sa)\
**Post date:** [March 5, 2024, 6:33am UTC](https://discuss.elastic.co/t/response-action/354614/3 "2024-03-05T06:33:13Z")

</div>

> [@lesio](#):
>
> verify the signing (stack side)

how can i verify the signing (stack side)?

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [March 5, 2024, 11:04am UTC](https://discuss.elastic.co/t/response-action/354614/4 "2024-03-05T11:04:30Z")

</div>

> [@mohd\_sa](#):
>
> how can i verify the signing (stack side)?

Could you modify Elastic Defend policy, change anything, un-check some event collection for example, and wait for it to be applied on that Endpoint. If it applies without issues then we're having a response action specific issue. Otherwise it'd suggest that signing at the stack side has changed.

I'm sorry, that it wasn't clear.

PS. Providing a stack and Elastic Defend version always helps, there could have been known issues for example. We will see all versions from diagnostic zip bundle anyway.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2024, 11:04am UTC](https://discuss.elastic.co/t/response-action/354614/5 "2024-04-02T11:04:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.