Overview
Endpoint Active Response lets a security analyst investigate and contain a device straight from the Ironclad portal. In the SOC Control Panel, choose Endpoint, pick an enrolled device, and run one of a fixed set of response actions. Each action collects one specific kind of evidence from the device (or, for quarantine, changes the device's network access) and shows the result in the portal.
Every action is predefined. There is nowhere to type a query, file path, process name, hash, or any other input: each action runs the same way every time. That keeps the feature predictable and safe to use in the middle of an incident.
There are 42 actions, organized by operating system: 2 that work on any device, 26 for Windows, 9 for Linux, and 5 for macOS. When you select a device, the Control Panel shows the cross-platform actions plus the ones for that device's operating system.
Before you start
- Endpoint Active Response must be enabled for the customer. In the Control Panel, choose Endpoint and select Enable Endpoint Active Response. Access is currently limited to platform administrators.
- The device must be enrolled. Either select Enroll this host in Active Response (Endpoint) when deploying the Ironclad Agent, or enroll an already-installed device with the command shown in the Control Panel. See Ironclad Agent Usage for the agent installation steps.
- The device should be online. Actions run on the device itself; if it is offline, the action waits and runs when the device reconnects.
How actions behave
- Read-only collections run as soon as you select Run and show their results in a table. Nothing on the device is changed.
- Confirmation for sensitive collections. A few read-only collections ask you to confirm first because they read personal browsing data, upload files from the device to the response server, or capture network traffic. They are marked "Asks for confirmation" in the tables below.
- Response actions (quarantine and release) change the device's network access. They always ask for confirmation, and you can log the result to an open case.
- Waiting time. Most collections finish in a few seconds. Some scans take a minute or more, and the Control Panel shows how long each can take while it waits. Each collection is stopped on the device if it runs past that limit. If the device has not reported back in time, the Control Panel says so and offers Check again; the results are kept.
- Large results. Results show the total number of rows and load a page at a time; select Load more rows to see more. Up to 5,000 rows can be viewed in the portal. Select Download full results (.zip) to get every row as a CSV file (it opens in Excel); a download of many thousands of rows can take a minute.
- Limits. To protect devices, a device runs at most three response collections at once, and there is a limit on how many actions can be started per minute. If you reach a limit, the Control Panel tells you how long to wait.
- Auditing. Every run is recorded with who ran it, which device it ran on, which action it was, and the outcome.
Cross-platform actions
These run on Windows, Linux, and macOS devices.
Processes
| Action |
What it does |
Collection |
Notes |
| Process tree / lineage |
Shows the full parent-to-child call chain for every running process, so you can see where a suspicious process came from (for example PowerShell spawned by Word). |
Generic.System.Pstree |
|
| Process siblings |
Lists processes that share the same parent as each running process, revealing the full set of activity a single parent kicked off (earlier shell commands, helper processes). |
Generic.System.ProcessSiblings |
|
Windows actions
Processes
| Action |
What it does |
Collection |
Notes |
| Running processes |
Lists every running process with its executable path, command line, and owning user. |
Windows.System.Pslist |
Slow: allow up to 2 min |
| Unexpected parent processes |
Flags well-known Windows processes whose parent is not the expected one (mapped to MITRE ATT&CK), a common sign of process masquerading or injection. |
Windows.Attack.ParentProcess |
|
| Suspicious svchost.exe instances |
Lists svchost.exe processes whose parent is not services.exe. Real svchost is always started by services.exe, so anything else is worth a look. |
Windows.System.SVCHost |
|
| System processes in unexpected locations |
Detects well-known system process names (like csrss.exe or lsass.exe) running from a path other than where Windows normally keeps them, a common malware disguise. |
Windows.Attack.UnexpectedImagePath |
|
| Scan process memory for Cobalt Strike |
Scans running processes in memory with a built-in Cobalt Strike detection rule and reports any matches. CPU-intensive on the device. Not yet confirmed to finish inside the wait limit on a busy workstation. |
Windows.Detection.Yara.Process |
Slow: allow up to 5 min |
Execution evidence
| Action |
What it does |
Collection |
Notes |
| Prefetch (what ran, even if deleted) |
Parses Windows prefetch files to show which programs have run, how many times, and when, even if the program has since been deleted. |
Windows.Forensics.Prefetch |
|
| Prefetch execution timeline |
Same prefetch data as above, laid out as a timeline of execution timestamps for building a sequence of events. |
Windows.Timeline.Prefetch |
|
| Prefetch matched to ATT&CK techniques |
Checks prefetch entries against tools and behaviours commonly mapped to MITRE ATT&CK techniques, highlighting known attacker tooling that has executed. |
Windows.Attack.Prefetch |
|
| Amcache (execution / first-seen evidence) |
Reads the Amcache to list programs that have run with their path and SHA1 hash, useful for spotting known-bad files and first-seen times. |
Windows.Detection.Amcache |
|
| PowerShell command history |
Extracts the saved PowerShell console command history for each user, showing what was typed at a PowerShell prompt. |
Windows.System.Powershell.PSReadline |
|
| Office documents containing macros |
Scans user folders for Office documents and extracts any embedded VBA macros. A macro that launches an external program (such as PowerShell) is highly suspicious. Slow on large profiles. |
Windows.Applications.OfficeMacros |
Slow: allow up to 4 min |
| TeamViewer incoming connections |
Parses the TeamViewer incoming-connection log to show who connected remotely, from where, and when. |
Windows.Applications.TeamViewer.Incoming |
|
Persistence
| Action |
What it does |
Collection |
Notes |
| Startup items (Run keys & Startup folders) |
Enumerates programs configured to start automatically from the registry Run keys and Startup folders, the most common persistence locations. |
Windows.Sys.StartupItems |
|
| Mapped admin shares (MountPoints2) |
Lists remotely mapped drives recorded in the MountPoints2 registry key, particularly ADMIN$ and other "$" shares, a simple indicator of lateral movement. |
Windows.Registry.MountPoints2 |
|
Network
| Action |
What it does |
Collection |
Notes |
| Network connections with process details |
Lists all network connections and listening ports together with the owning process, its path, hash, and signature. Read-only: the kill and dump options are not used. |
Windows.Network.NetstatEnriched |
Slow: allow up to 3 min |
| Hosts file entries |
Reads the Windows hosts file. Unexpected entries can silently redirect security or update sites to attacker-controlled addresses. |
Windows.System.HostsFile |
|
Browsers & applications
| Action |
What it does |
Collection |
Notes |
| Chrome browsing history |
Lists visited URLs, page titles, and visit times from Chromium-based browsers (Chrome, Edge, Brave, Vivaldi, Opera) for every user. |
Windows.Applications.Chrome.History |
|
| Edge browsing history |
Lists visited URLs, page titles, and visit times from Microsoft Edge for every user. |
Windows.Applications.Edge.History |
|
| Firefox browsing history |
Lists visited URLs and visit times from Firefox for every user. |
Windows.Applications.Firefox.History |
|
| Firefox downloads |
Lists files downloaded in Firefox with their source URL and timestamps. |
Windows.Applications.Firefox.Downloads |
|
| Chrome extensions |
Lists installed Chrome extensions and the permissions each one requests, a frequent vector for credential and session theft. |
Windows.Applications.Chrome.Extensions |
|
| Chrome cookies (metadata) |
Collects Chrome cookie metadata (site, cookie name, created and last-accessed times). Values normally stay encrypted. Sensitive: asks for confirmation first. |
Windows.Applications.Chrome.Cookies |
Asks for confirmation |
System integrity
| Action |
What it does |
Collection |
Notes |
| Security service status |
Checks that important security and update services (antivirus and similar) are installed and currently running. Stopped or disabled services can indicate tampering. |
Windows.System.CriticalServices |
|
| Scan UEFI / EFI partition for rootkits |
Scans files on the EFI System Partition with a built-in bootkit detection rule (BlackLotus and similar). Reads the disk directly. |
Windows.Detection.Yara.UEFI |
Slow: allow up to 3 min |
Linux actions
Network
| Action |
What it does |
Collection |
Notes |
| Network connections and listeners |
Lists listening and established sockets with the owning process, read directly from the kernel network tables. |
Linux.Network.Netstat |
|
| Capture 10 seconds of network traffic |
Runs tcpdump for 10 seconds on all interfaces and uploads the PCAP to the response server. Sensitive: asks for confirmation first. |
Linux.Network.PacketCapture |
Asks for confirmation |
Software
| Action |
What it does |
Collection |
Notes |
| Installed packages (deb / snap) |
Lists installed deb and snap packages with versions, for spotting unexpected or outdated software. |
Linux.Debian.Packages |
|
| Upload Chrome extension files |
Uploads the Chrome extension files from each user home directory to the response server for offline analysis. Sensitive: asks for confirmation first. |
Linux.Applications.Chrome.Extensions.Upload |
Asks for confirmation |
Users & access
| Action |
What it does |
Collection |
Notes |
| SSH known hosts |
Finds and parses SSH known_hosts files, showing which remote machines each user has connected to (useful for tracing lateral movement). |
Linux.Ssh.KnownHosts |
|
| Local groups and members |
Lists system groups, their IDs, and members from /etc/group. |
Linux.Sys.Groups |
|
| Users with sudo/root access |
Detects accounts that have been added to the sudo group. |
Linux.Users.RootUsers |
|
macOS actions
Processes
| Action |
What it does |
Collection |
Notes |
| Running processes |
Lists running processes and the binaries behind them. |
MacOS.Sys.Pslist |
|
Persistence
| Action |
What it does |
Collection |
Notes |
| Autoruns / persistence locations |
Searches launch agents/daemons, login items, cron and other persistence locations and uploads what it finds. Sensitive: asks for confirmation first. |
MacOS.Detection.Autoruns |
Asks for confirmation |
Browsers & applications
| Action |
What it does |
Collection |
Notes |
| Chrome browsing history |
Lists visited URLs, titles, and visit times from Chrome for every user. |
MacOS.Applications.Chrome.History |
|
Users & access
| Action |
What it does |
Collection |
Notes |
| Local user accounts |
Lists the local user accounts (real users only) from the macOS directory plists. |
MacOS.System.Users |
|
System integrity
| Action |
What it does |
Collection |
Notes |
| setuid / setgid binaries |
Finds applications with the setuid or setgid bit set, which run with their owner's privileges and are a classic privilege-escalation target. |
MacOS.Sys.SUID |
|
Quarantine and release
Quarantine is the containment action. It cuts a device off from the network so an investigation can continue without the device talking to anything else, while keeping the connection the analyst needs.
| Action |
What it does |
Collection |
Notes |
| Quarantine device |
Isolates the device from the network using a Windows IPsec policy, leaving only DNS, DHCP, and the link back to the response console. |
Windows.Remediation.Quarantine |
Changes the device; asks for confirmation |
| Release from quarantine |
Removes the quarantine policy and restores normal network access. |
Windows.Remediation.Quarantine |
Changes the device; asks for confirmation |
| Quarantine device |
Isolates the device from the network using nftables, leaving only DNS and the link back to the response console. Requires nftables on the device. |
Linux.Remediation.Quarantine |
Changes the device; asks for confirmation |
| Release from quarantine |
Removes the nftables quarantine table and restores normal network access. |
Linux.Remediation.Quarantine |
Changes the device; asks for confirmation |
- Windows devices are quarantined with a Windows IPsec policy. Only DNS, DHCP, and the connection back to the response console stay open.
- Linux devices are quarantined with nftables, so the
nft tool must be installed on the device. Only DNS and the connection back to the response console stay open.
- macOS devices do not have a quarantine action.
- Release a quarantined device as soon as the investigation allows. Use Release from quarantine on the same device to restore normal network access.
What is not included
Only collections that run meaningfully on their own, with no input from the analyst, are offered. Anything that needs a value typed in (for example a hash hunt, a custom YARA rule, a regular-expression filter, a memory dump of a named process, or a file-share search) is intentionally not available, so no action can be steered by free-form input.