Generate a memory dump from the host machine

POST /api/endpoint/action/memory_dump
Api key auth

Spaces method and path for this operation:

post /s/{space_id}/api/endpoint/action/memory_dump

Refer to Spaces for more information.

Generates memory dumps on the targeted host.

application/json

Body Required

  • agent_type string

    List of agent types to retrieve. Defaults to endpoint.

    Values are endpoint, sentinel_one, crowdstrike, or microsoft_defender_endpoint.

  • alert_ids array[string]

    If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.

    At least 1 but not more than 50 elements. Minimum length of each is 1.

  • case_ids array[string]

    The IDs of cases where the action taken will be logged. Max of 50.

    At least 1 but not more than 50 elements. Minimum length of each is 1.

  • comment string

    Optional comment

  • endpoint_ids array[string] Required

    List of endpoint IDs (cannot contain empty strings). Max of 250.

    At least 1 but not more than 250 elements. Minimum length of each is 1.

  • parameters object Required

    One of:
    object-1 object object-2 object object-3 object
  • parameters object

    Optional parameters object

Responses

  • 200 application/json

    Action request was successfully created

    Hide response attribute Show response attribute object
    • data object
      Hide data attributes Show data attributes object
      • agents array[string(uuid)]

        The agent IDs for the hosts that the response action was sent to

      • agentState object

        The state of the response action for each agent ID that it was sent to

        Hide agentState attribute Show agentState attribute object
        • * object(uuid) Additional properties
          Hide * attributes Show * attributes object(uuid)
          • completedAt string

            The date and time the response action was completed for the agent ID

          • isCompleted boolean

            Whether the response action is completed for the agent ID

          • wasSuccessful boolean

            Whether the response action was successful for the agent ID

      • agentType string

        List of agent types to retrieve. Defaults to endpoint.

        Values are endpoint, sentinel_one, crowdstrike, or microsoft_defender_endpoint.

      • command string Required

        The command for the response action

        Minimum length is 1. Values are isolate, unisolate, kill-process, suspend-process, running-processes, get-file, execute, upload, scan, runscript, cancel, or memory-dump.

      • completedAt string(date-time)

        The response action completion time

      • createdBy string

        The user who created the response action

      • hosts object

        An object containing the host names associated with the agent IDs the response action was sent to

        Hide hosts attribute Show hosts attribute object
        • * object(uuid) Additional properties
          Hide * attribute Show * attribute object(uuid)
          • name string

            The host name

      • id string(uuid)

        The response action ID

      • isComplete boolean

        Whether the response action is complete

      • isExpired boolean

        Whether the response action is expired

      • outputs object

        The outputs of the response action for each agent ID that it was sent to. Content different depending on the response action command and will only be present for agents that have responded to the response action

        Hide outputs attribute Show outputs attribute object
        • * object(uuid) Additional properties

          The agent id

          Hide * attributes Show * attributes object(uuid)

          • content object | string Required

            The response action output content for the agent ID. Exact format depends on the response action command.

            One of:
            object-1 object string-2 string
          • type string Required

            Values are json or text.

      • parameters object

        The parameters of the response action. Content different depending on the response action command

      • startedAt string(date-time)

        The response action start time

      • status string

        The response action status

      • wasSuccessful boolean

        Whether the response action was successful
POST /api/endpoint/action/memory_dump 
curl \
 --request POST 'https://<KIBANA_URL>/api/endpoint/action/memory_dump' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"comment":"Generating memory dump for investigation","agent_type":"endpoint","parameters":{"type":"process","entity_id":"abc123"},"endpoint_ids":["ed518850-681a-4d60-bb98-e22640cae2a8"]}'
Request example 
{
  "comment": "Generating memory dump for investigation",
  "agent_type": "endpoint",
  "parameters": {
    "type": "process",
    "entity_id": "abc123"
  },
  "endpoint_ids": [
    "ed518850-681a-4d60-bb98-e22640cae2a8"
  ]
}
Response examples (200) 
{
  "data": {
    "id": "233db9ea-6733-4849-9226-5a7039c7161d",
    "hosts": {
      "ed518850-681a-4d60-bb98-e22640cae2a8": {
        "name": "gke-node-1235412"
      }
    },
    "agents": [
      "ed518850-681a-4d60-bb98-e22640cae2a8"
    ],
    "status": "pending",
    "command": "memory-dump",
    "outputs": {},
    "agentType": "endpoint",
    "createdBy": "elastic",
    "isExpired": false,
    "startedAt": "2022-07-29T19:08:49.126Z",
    "agentState": {
      "ed518850-681a-4d60-bb98-e22640cae2a8": {
        "isCompleted": false,
        "wasSuccessful": false
      }
    },
    "parameters": {
      "type": "process",
      "entity_id": "abc123"
    },
    "isCompleted": false,
    "wasSuccessful": false
  }
}