Automated response actionsedit
Add Elastic Defend’s response actions to detection rules to automatically perform actions on an affected host when an event meets the rule’s criteria. Use these actions to support your response to detected threats and suspicious events.
You can add automated response actions to a new or existing custom query rule.
-
Do one of the following:
- New rule: On the last step of custom query rule creation, go to the Response Actions section and select Elastic Defend.
- Existing rule: Edit the rule’s settings, then go to the Actions tab. In the tab, select Elastic Defend under the Response Actions section.
-
Select an option in the Response action field:
- Isolate: Isolate the host, blocking communication with other hosts on the network.
- Kill process: Terminate a process on the host.
- Suspend process: Temporarily suspend a process on the host.
Be aware that automatic host isolation can result in unintended consequences, such as disrupting legitimate user activities or blocking critical business processes.
-
For process actions, specify how to identify the process you want to terminate or suspend:
- Turn on the toggle to use the alert’s process.pid value as the identifier.
- To use a different alert field value to identify the process, turn off the toggle and enter the Custom field name.
- Enter a comment describing why you’re performing the action on the host (optional).
- To finish adding the response action, click Create & enable rule (for a new rule) or Save changes (for existing rules).