Action details panel

The Action details panel gives you a closer look at an action event.

From this panel, you can view information, including:

• the action event's description, timestamp, and result/status
• associated entities and their labels
• the related detection and policy for an automated (policy-initiated) action, or the name of the operator for a manual action
• key, action type-specific information, such as the text displayed for a display message action (supported with Agent 11.0.1+ only) and the user's response to any URLs and acknowledgement checkboxes presented within the message, and
• log messages.

Actions that require a file upload, including take screenshot and make shadow copy, take longer to complete than other actions. If an action is viewed from an associated Detection details panel before it completes, it will display as "Not found" until it succeeds or fails.

Additionally, from the Action details panel, you can:

• add the action event to a case
• execute searches, filtering by associated properties, and
• find events occurring around the time the action was executed.

Action details panel