Skip to main content

Remediation actions

Updated

Remediation actions let you respond to a confirmed threat directly from the Defend console without needing to log into the affected endpoint. Available actions include killing a running process, collecting a forensics snapshot, and running a SOAR playbook. Actions are delivered to the agent on its next heartbeat, which is typically within seconds for an online device.

Killing a Running Process

⚠️ This action cannot be driven from the Defend console today. Corrected 2026-08-04. The steps previously published here — click Kill Process, then "enter the process ID or process name, both formats are accepted" — described a button and an input field that the console does not have, and a name-based option the API does not accept.

What is actually true, and the scope of each statement:

  • A numeric process ID (PID) is required. The remediation API allows a process_name field but requires process_id; a request carrying only a name is rejected before it reaches the endpoint. So "either format" was never correct — it was always PID-or-nothing.

  • There is no PID input in the console. The device page offers Isolate, Release from Isolation, Collect Forensics, Restore from Backup and Uninstall Token — no Kill Process. The one place the action is offered is the incident decision panel's "Stop the process" choice, and it sends no PID, so it fails and reports sent to 0/1 devices · 1 failed.

  • Scope of that statement: this was verified against the Hub portal (the Defend console you log into). It is not a claim that no interface anywhere can kill a process — an internal, service-authenticated RMM route does accept a process name, and the endpoint agent does implement a kill-by-name. Neither is reachable from the console, and neither is what this article documented.

What to do instead today: stop the process through an RMM remote session or a script, then quarantine the file and collect forensics as below.

Still true, and worth keeping in mind for when this lands: killing a process does not remove the executable file or undo any changes it has already made. Follow up with a file quarantine or a forensics collection to understand what the process wrote to disk. A PID is also reused by the operating system, which is why a name-based kill is not simply a convenience — a stale PID can kill the wrong process.

Collecting Forensics

A forensics collection gathers a point-in-time snapshot of the device's state for offline analysis.

  1. Open the device or alert.
  2. Click Collect Forensics.
  3. The agent gathers:
    • Running processes and their command lines.
    • Active network connections.
    • Recent system logs.
    • Optionally, a memory snapshot (slower and produces a larger bundle).
  4. The agent uploads the package in chunks. When the upload is complete, a download link appears on the device detail page.

Forensics bundles are useful when you need deeper analysis than the platform's process tree and timeline provide, or when you need to share evidence outside the platform.

Note: Bundles that include memory snapshots can take many minutes to upload on slow links. If a bundle never completes, retry without the memory snapshot option.

Running a SOAR Playbook

Playbooks let you execute a predefined sequence of investigation and response steps from a single button click.

  1. From an alert or device, click Run Playbook.
  2. Select the playbook from the list.
  3. Confirm. The playbook executor runs each step in order — queries, decisions, and actions — and records the result of each step.

Playbook execution history is visible under SOAR → Playbook Executions. Each run shows which steps completed, which steps failed, and what actions were taken.

For instructions on building playbooks, see Policies or the SOAR documentation.

Response Actions Through RMM

For devices that are enrolled in both Defend and RMM, certain response commands are sent through the RMM integration as an alternative delivery channel. This includes isolate and forensics-snapshot commands. (Kill process can't be driven from the console today — see Killing a Running Process above.) The console presents a unified interface — you do not need to switch tools to take action.

Audit Trail

Every response action is logged. The audit log captures who issued the action, when it was issued, the parameters used, and the outcome reported by the agent. This log is available on the device detail page.

FAQ

Can I kill a process by name instead of PID? Not from the Defend console today. See Killing a Running Process above: the console has no kill-by-name or PID input. Stop the process through an RMM remote session or a script instead.

What happens if the device is offline when I issue an action? The command is queued. When the device comes back online and checks in, the pending command is delivered and executed. The device detail page shows the command as pending until it is picked up.

Can response actions be automated? The capability is built, but it is off by default and has to be turned on for your environment before anything runs on its own. Once it is enabled, you wire a SOAR playbook to a detection rule in the policy settings and the playbook runs when the rule fires (this also depends on detections evaluating, which is currently limited). Until then, a matching rule raises an alert and a technician takes the action — so do not plan around automatic containment without arranging it with us first.

Related