On the endpoint, through the agent
| Action | Notes |
|---|---|
| Isolate host | See Network isolation. |
| Release host | Restores the previous firewall state. |
| Kill process | Refused if the process id now belongs to a different program. |
| Block application | By image name or hash. See Application control. |
| Collect file | Into Response › Collected files. |
Quick triage is run by an analyst from the host's page. See Quick triage.
In other systems, through integrations
| Action | Integration | Status |
|---|---|---|
| Disable user, clear sessions | Okta | Live |
| Disable user, revoke sessions | Microsoft 365 / Entra ID | Live |
| Quarantine email (move to Junk) or delete it | Microsoft 365 / Entra ID | Live |
| Block IP at the firewall | FortiGate | Live |
| Isolate device, block hash | Microsoft Defender for Endpoint | Coming soon |
Each action needs the integration configured in Settings › Integrations with a credential that has the matching permission. Grant write permissions only for actions you intend to use.
Governance
Every execution, automatic or by an analyst, is recorded with its run or its operator and lands in the audit log. Organization guardrails decide which actions may ever run automatically. See Modes and ceilings.