run_active_response
Execute active response commands on agents to block threats, disable accounts, or restart services for immediate security action.
Instructions
Execute an active response command on an agent.
Triggers a configured active response action on a specific agent. Common commands include firewall-drop, host-deny, disable-account, etc.
⚠️ WARNING: This performs real actions on the agent! Ensure you understand the command's effect before executing.
Args: agent_id: Target agent ID (e.g., '001'). Use '000' for the manager. command: Active response command name (e.g., 'firewall-drop', 'host-deny', 'restart-ossec', 'disable-account'). arguments: Optional space-separated arguments (e.g., IP to block: '10.0.0.5').
Returns: JSON object indicating success or failure.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes | ||
| command | Yes | ||
| arguments | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |