Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feedback]: EndpointIsolateAction doc has a response example for the "suspend-process" action #810

Open
burchzc opened this issue Mar 17, 2025 · 0 comments

Comments

@burchzc
Copy link

burchzc commented Mar 17, 2025

Was the documentation helpful?

Yes

What documentation page is affected

Link to page: https://www.elastic.co/docs/api/doc/kibana/v8/operation/operation-endpointisolateaction

Description

Link to source code: https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/security_solution/common/api/endpoint/actions/response_actions/isolate/isolate.schema.yaml

The example request for the Endpoint Isolate Action seems correct, but the listed example response shows that it's for the suspend process command and doesn't match the output I get when testing.

Expected output would be for something in this general format

{ "body": { "action": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "data": { "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "agentType": "endpoint", "agents": [ "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" ], "hosts": { "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx": { "name": "test system" } }, "command": "isolate", "startedAt": "2025-03-17T18:15:47.166Z", "isCompleted": false, "wasSuccessful": false, "isExpired": false, "status": "pending", "outputs": {}, "agentState": { "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx": { "isCompleted": false, "wasSuccessful": false } }, "createdBy": "XXXXXXXXX", "comment": "test" } } }

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants