Skip to content

Commit 9f9fef3

Browse files
[Security] Enable endpoint actions in events (#2042)
Resolves #674 by documenting that endpoint actions are available for events. Previews: * [Endpoint response actions](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/2042/solutions/security/endpoint-response-actions) * [Isolate a host](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/2042/solutions/security/endpoint-response-actions/isolate-host)
1 parent 246098e commit 9f9fef3

File tree

2 files changed

+7
-11
lines changed

2 files changed

+7
-11
lines changed

solutions/security/endpoint-response-actions.md

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,12 +40,8 @@ Launch the response console from any of the following places in {{elastic-sec}}:
4040
* **Endpoints** page → **Actions** menu (****) → **Respond**
4141
* Endpoint details flyout → **Take action****Respond**
4242
* Alert details flyout → **Take action****Respond**
43-
44-
::::{note}
45-
In {{serverless-short}}, you can also launch the response console from the event details flyout (event details flyout → **Take action****Respond**).
46-
::::
47-
4843
* Host details page → **Respond**
44+
* {applies_to}`stack: ga 9.1` Event details flyout → **Take action****Respond**
4945

5046
To perform an action on the endpoint, enter a [response action command](/solutions/security/endpoint-response-actions.md#response-action-commands) in the input area at the bottom of the console, then press **Return**. Output from the action is displayed in the console.
5147

solutions/security/endpoint-response-actions/isolate-host.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,9 @@ All actions executed on a host are tracked in the host’s response actions hist
4949

5050
## Isolate a host [isolate-a-host]
5151

52-
::::{dropdown} Isolate a host from an event (Serverless only) or a detection alert
53-
1. Open an event ({{serverless-short}} only) or a detection alert:
54-
* From the event analyzer view: Click an event. ({{serverless-short}} only)
52+
::::{dropdown} Isolate a host from an event or a detection alert
53+
1. Do one of the following:
54+
* {applies_to}`stack: ga 9.1` From the event analyzer view: Click an event.
5555
* From the Alerts table or Timeline: Click **View details** (![View details icon](/solutions/images/security-view-details-icon.png "title =20x20")).
5656
* From a case with an attached alert: Click **Show alert details** (**>**).
5757

@@ -120,9 +120,9 @@ After the host is successfully isolated, an **Isolated** status is added to the
120120

121121
## Release a host [release-a-host]
122122

123-
::::{dropdown} Release a host from an event (Serverless only) or detection alert
124-
1. Open an event ({{serverless-short}} only) or a detection alert:
125-
* From the event analyzer view: Click an event. ({{serverless-short}} only)
123+
::::{dropdown} Release a host from an event or detection alert
124+
1. Do one of the following:
125+
* {applies_to}`stack: ga 9.1` From the event analyzer view: Click an event.
126126
* From the Alerts table or Timeline: Click **View details** (![View details icon](/solutions/images/security-view-details-icon.png "title =20x20")).
127127
* From a case with an attached alert: Click **Show alert details** (**>**).
128128

0 commit comments

Comments
 (0)