VERISCO Alertio Respond

Response actions

The eight actions Alertio can carry out on an endpoint, how risky each one is, who may run it, and how every action is previewed, confirmed and recorded.

A response action is one thing done to one or more endpoints, carried out by the agent on the machine. Every action, wherever it starts, goes through the same path: preview, confirm, execute, record.

The actions#

Action	Effect	Risk	Can be undone	Who can run it
Block IP	Blocks an address at the endpoint's firewall.	Medium	Yes: Release IP block, or it lifts after 10 minutes	Analyst, Administrator
Release IP block	Removes a block.	Low	—	Analyst, Administrator
Isolate host	Cuts the machine off the network. The most disruptive action available.	Destructive	Yes: Release isolation	Administrator
Release isolation	Restores network access, by undoing the isolation.	Low	—	Analyst, Administrator
Kill process	Terminates a running process.	Destructive	No	Administrator
Quarantine file	Moves a file into quarantine.	Destructive	No	Administrator
Run command	Runs a configured command or one of your response scripts.	High	No	Analyst, Administrator
Restart agent	Restarts the agent on the machine.	Medium	No	Analyst, Administrator

Isolation

Isolating a host removes it from the network, including from you. Only isolate a machine you can still reach by other means, such as its console.

Where actions start#

From	How
Response Center → Quick Actions	One action, chosen and configured directly.
Endpoints → Response tab	One action against the machine you are looking at. See Endpoints.
An incident → Run playbook	A sequence of actions. See Playbooks.

A quick action is a one-step playbook run, so it gets exactly the same guardrails, record and undo as a full playbook.

Running a quick action#

Choose the action

In Response Center, open Quick Actions, choose the action type and, where it has several, the command.
Set the parameters and scope

Supply what the action needs, such as an address, a process or a file. Choose the scope: specific agents, or all endpoints.
Preview

Preview shows exactly what will happen, to which machines, and the risk, before anything is carried out.
Confirm and execute

High-risk and destructive actions require you to tick the acknowledgement first. Nothing runs from a single click.

The record#

Response History lists every action the platform has carried out, with its time, its origin, its target, the agent, its status, its risk, who ran it and the result.

Status	Means
Sent	Delivered to the endpoint.
Failed	The endpoint or the platform reported an error. The result says which.
Refused	The platform declined to run it, and says why.
Expired	A block that has lifted after its timeout.
Reverted	Undone, by its release action or by undoing the run.

Statuses are honest: an action the endpoint never confirmed is never shown as a success. Filter by origin (Playbooks, Quick Actions, Blocks), by action, status, risk or agent, or show only the blocks in force now with active blocks.

The Response Center history: each action with its time, action type, source playbook or quick action, target, agent, status, risk level, actor and result. — Response History. Every action, where it came from, what it targeted, and what came of it. Addresses are blurred.

Every finished action also raises a notification.

Something missing or wrong on this page? Tell us and we will fix it.