Actions

Response actions are a core mechanism that allow detection rules to actively react to security-relevant events. Actions are responses executed as a consequence of rule matches. They provide alerting and prevention capabilities aim at stopping the adversary at the initial stages of the attack.

Instead of merely observing and alerting, response actions enable to perform automated operations when a rule matches an event condition. This triggers immediate reaction to suspicious behavior such as process creation, injection attempts, or anomalous file activity.