Response Actions
Understand the response actions that appear in your cases.
When you execute a response action during incident response, such as disabling a compromised user account or isolating an infected endpoint, it's essential to understand what that action does, which systems it affects, and whether it can safely be reversed.
This comprehensive reference guide documents all available response actions across your integrated security platforms, including their required parameters, API endpoints, impact levels, and - most importantly - their undo capabilities. Many actions can be automatically reversed with a single click, giving you full control to contain threats confidently and restore normal operations when incidents are resolved. Use this guide to make informed decisions during incident response and understand the full scope of each remediation action.
Prerequisites
Find your action connector
CrowdStrike Actions
CrowdStrike action connectors use the CrowdStrike Falcon API to perform endpoint detection and response (EDR) actions. These actions are commonly used for endpoint containment, threat intelligence, and indicator management during incident response. CrowdStrike Falcon provides cloud-native endpoint protection with real-time threat intelligence.
Primary use cases: Endpoint containment, custom IOC management, threat blocking
Action: Block File
Blocks a file by hash in CrowdStrike Falcon using custom Indicators of Compromise (IOCs). Supports SHA256, SHA1, and MD5 hashes. Blocked files are prevented from executing on all managed endpoints.
Required Parameters
At least one of: hash_sha256, hash_sha1, or hash_md5
API Endpoints
POST /iocs/entities/indicators/v1
Undo Action
No
Required Permissions
IOCs (Indicators of Compromise): Write
Impact Level
High - Blocks file across all endpoints
Action: Isolate Device
Isolates a device in CrowdStrike Falcon, preventing it from communicating with other devices on the network.
Required Parameters
device_id (Falcon sensor ID/AID)
API Endpoints
POST /devices/entities/devices-actions/v2?action_name=contain
Undo Action
Yes - via release_device action
Required Permissions
Hosts: Write
Impact Level
High - Device network isolated
Action: Release Device
Releases an isolated device in CrowdStrike Falcon (lift containment), restoring normal network communication.
Required Parameters
device_id (Falcon sensor ID/AID)
API Endpoints
POST /devices/entities/devices-actions/v2?action_name=lift_containment
Undo Action
Yes - via isolate_device action
Required Permissions
Hosts: Write
Impact Level
Low - Restores network access
Google Workspace Actions
Google Workspace action connectors use the Google Workspace Admin SDK and Gmail API to perform email security and user management actions. These actions are commonly used for email threat remediation and sender blocking during incident response. Google Workspace provides cloud-based productivity and collaboration tools with integrated security controls.
Primary use cases: Phishing email removal, malicious sender blocking
Action: Block Sender
Blocks an email sender for all users with mailbox setup in the Google Workspace organization. Creates Gmail filters for each user that automatically deletes emails from the blocked sender.
Required Parameters
email_from
API Endpoints
GET /admin/directory/v1/users (with customer: "my_customer")
POST /gmail/v1/users/me/settings/filters
Undo Action
No - Manual filter removal required for each user
Required Permissions
https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/gmail.settings.basic
Impact Level
High - Affects all users in the organization
Action: Find and Soft Delete Emails
Finds emails matching sender and subject across all user mailboxes in Google Workspace and moves them to trash (soft delete). Emails remain in trash for 30 days before automatic permanent deletion. Uses Gmail search query with sender and subject criteria.
Required Parameters
email_from, email_subject
API Endpoints
GET /admin/directory/v1/users (with customer: "my_customer")
GET /gmail/v1/users/me/messages (with query)
POST /gmail/v1/users/me/messages/${id}/trash
Undo Action
No - Manual recovery from trash required
Required Permissions
https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/gmail.modify
Impact Level
Medium - Emails can be recovered from trash
Action: Find and Hard Delete Emails
Finds emails matching sender and subject across all user mailboxes in Google Workspace and permanently deletes them (hard delete). This action bypasses trash and cannot be undone.
Warning: This action is irreversible. Use soft delete when possible.
Required Parameters
email_from, email_subject
API Endpoints
GET /admin/directory/v1/users (with customer: "my_customer")
GET /gmail/v1/users/me/messages (with query)
DELETE /gmail/v1/users/me/messages/${id}
Undo Action
No - Permanent deletion
Required Permissions
https://www.googleapis.com/auth/admin.directory.user.readonly, and https://mail.google.com/
Impact Level
High - Irreversible action
KnowBe4 Actions
KnowBe4 action connectors use the KnowBe4 Reporting API to perform security awareness training actions. These actions are commonly used for phishing training enrollment and user education during and after security incidents. KnowBe4 provides security awareness training and simulated phishing campaigns.
Primary use cases: Post-incident training, phishing awareness education
Action: Enroll in Phishing Training
Enrolls a user in phishing training via KnowBe4. Uses the case number and user display name for context in the training enrollment event. This helps track training related to specific security incidents.
Required Parameters
user_principal_name
API Endpoints
POST /events
Undo Action
No - Training enrollment cannot be undone
Required Permissions
User Event API: Write
Impact Level
Low - Educational action only
Microsoft 365 Actions
Microsoft 365 action connectors use Microsoft Graph API, Microsoft Defender for Endpoint API, and Exchange Online API to perform response actions across endpoints, email, identity, and security controls. These actions are commonly used for containment, remediation, and account protection during incident response. The connector integrates with multiple Microsoft security services including Azure AD, Exchange Online, and Microsoft Defender.
Primary use cases: Account compromise response, email security, endpoint containment, malware blocking
Action: Disable Users and Terminate Active Sessions
Composite action that disables a user account and revokes all sign-in sessions in Microsoft 365. This is a combination of disable_user and revoke_sign_in_sessions actions, providing immediate account lockdown across all Microsoft services.
Required Parameters
user_principal_name, user_id, or service_account_id
API Endpoints
PATCH /users/${userIDorEmail} (with {accountEnabled: false})
POST /users/${userIDorEmail}/revokeSignInSessions
Undo Action
Yes - via enable_user action
Required Permissions
User.ReadWrite.All, User.RevokeSessions.All
Impact Level
High - User cannot access Microsoft 365 services
Action: Terminate Active Sessions
Required PermissionsRevokes all sign-in sessions for a user in Microsoft 365, forcing them to re-authenticate. The user account remains enabled but all refresh tokens are invalidated.
Required Parameters
user_principal_name, user_id, or service_account_id
API Endpoints
POST /users/${userIDorEmail}/revokeSignInSessions
Undo Action
No - Sessions already terminated
Required Permissions
User.RevokeSessions.All
Impact Level
Medium - User can re-authenticate
Action: Enable User
Enables a previously disabled user account in Microsoft 365, allowing them to sign in again. Restores access to all Microsoft 365 services.
Required Parameters
user_principal_name, user_id, or service_account_id
API Endpoints
PATCH /users/${userIDorEmail} (with {accountEnabled: true})
Undo Action
Yes - via disable_users_and_terminate_active_sessions action
Required Permissions
User.ReadWrite.All, User.EnableDisableAccount.All
Impact Level
Low - Restores normal access
Action: Reset User Password
Resets a user's password in Microsoft 365 and revokes all sign-in sessions, forcing them to change password on next sign-in.
Required Parameters
user_principal_name, user_id, or service_account_id
API Endpoints
PATCH /users/${userIDorEmail} (with {passwordProfile: {forceChangePasswordNextSignIn: true}})
POST /users/${userIDorEmail}/revokeSignInSessions
Undo Action
No - Password already changed
Required Permissions
User.ReadWrite.All, User.RevokeSessions.All, User.EnableDisableAccount.All, andDirectory.AccessAsUser.All (delegated permission)
Impact Level
High - User must reset password
Action: Disable All Forward Rules
Disables all email forwarding rules for a user in Microsoft 365 Exchange Online. Rules remain configured but are set to inactive, preventing unauthorized email forwarding while preserving rule configurations.
Required Parameters
user_principal_name
API Endpoints
GET /users/${userID}/mailFolders/inbox/messageRules
PATCH /users/${userID}/mailFolders/inbox/messageRules/${ruleID} (with {isEnabled: false})
Undo Action
No - Manual re-enablement required
Required Permissions
MailboxSettings.ReadWrite
Impact Level
Medium - Stops email forwarding
Action: Delete External Forward Rules
Deletes all email forwarding rules that forward to external domains (domains not in the organization's verified domain list). Internal forwarding rules are preserved.
Required Parameters
user_principal_name
API Endpoints
GET /domains
GET /users/${userID}/mailFolders/inbox/messageRules
DELETE /users/${userID}/mailFolders/inbox/messageRules/${ruleID}
Undo Action
No - Rules permanently deleted
Required Permissions
Domain.Read.All, MailboxSettings.ReadWrite
Impact Level
High - Permanently removes rules
Action: Find and Soft Delete Emails
Finds emails matching sender and subject in recipient mailboxes and moves them to the Deleted Items folder (soft delete). Emails can be recovered from Deleted Items. Searches each recipient's mailbox individually using sender + subject criteria.
Required Parameters
email_from, email_subject, email_to (array of recipient email addresses)
API Endpoints
GET /domains
GET /users/${userIDorEmail}/messages/ (with filter subject eq '...' and sender/emailAddress/address eq '...')
POST /users/${userIDorEmail}/messages/${messageID}/move (with {destinationId: "deleteditems"})
Undo Action
Yes - via restore_soft_deleted_emails action
Required Permissions
Mail.ReadWrite
Impact Level
Low - Emails can be recovered
Action: Find and Hard Delete Emails
Finds emails matching sender and subject in recipient mailboxes and permanently deletes them (hard delete). This action bypasses the Deleted Items folder and cannot be undone.
Warning: This action is irreversible. Use soft delete when possible.
Required Parameters
email_from, email_subject, email_to (array of recipient email addresses)
API Endpoints
GET /users/${userIDorEmail}/messages/ (with filter subject eq '...' and sender/emailAddress/address eq '...')
DELETE /users/${userIDorEmail}/messages/${messageID}
Undo Action
No - Permanent deletion
Required Permissions
Mail.ReadWrite
Impact Level
High - Irreversible action
Action: Restore Soft Deleted Emails
Restores soft-deleted emails from the Deleted Items folder back to the recipient's inbox. This is the reversal action for find_and_soft_delete_emails.
Required Parameters
email_from, email_subject, email_to (array of recipient email addresses)
API Endpoints
GET /users/${userIDorEmail}/mailFolders/deleteditems/messages/ (with filter)
POST /users/${userIDorEmail}/messages/${messageID}/move (with {destinationId: "inbox"})
Undo Action
Yes - via find_and_soft_delete_emails action
Required Permissions
Mail.ReadWrite
Impact Level
Low - Restores emails
Action: Isolate Device
Isolates a device using Microsoft Defender for Endpoint, preventing it from communicating with other devices on the network. The device can still communicate with Defender services for management.
Required Parameters
device_id (Defender sensor ID)
API Endpoints
POST https://api.securitycenter.microsoft.com/api/machines/${sensorID}/isolate
Undo Action
Yes - via release_device action
Required Permissions
Machine.Isolate
Impact Level
High - Device network isolated
Action: Release Device
Releases a device from isolation in Microsoft Defender for Endpoint, restoring normal network communication.
Required Parameters
device_id (Defender sensor ID)
API Endpoints
POST https://api.securitycenter.microsoft.com/api/machines/${sensorID}/unisolate
Undo Action
Yes - via isolate_device action
Required Permissions
Machine.Isolate
Impact Level
Low - Restores network access
Action: Block File
Blocks a file by hash using Microsoft Defender for Endpoint Indicators API. Supports SHA256, SHA1, and MD5 hashes with priority: SHA256 > SHA1 > MD5. Blocked files are prevented from executing across all managed endpoints.
Required Parameters
file_name, and at least one of: hash_sha256, hash_sha1, or hash_md5
API Endpoints
POST https://api.securitycenter.microsoft.com/api/indicators
Undo Action
Yes - via unblock_file action
Required Permissions
Ti.ReadWrite or Ti.ReadWrite.All
Impact Level
High - Blocks file execution globally
Action: Unblock File
Unblocks a previously blocked file by removing its indicator from Microsoft Defender for Endpoint. This is the reversal action for block_file.
Required Parameters
file_name, and at least one of: hash_sha256, hash_sha1, or hash_md5
API Endpoints
GET https://api.securitycenter.microsoft.com/api/indicators (with filter)
DELETE https://api.securitycenter.microsoft.com/api/indicators/${indicatorID}
Undo Action
Yes - via block_file action
Required Permissions
Ti.ReadWrite or Ti.ReadWrite.All
Impact Level
Low - Removes file block
Action: Block Domain
Blocks a domain using Microsoft Defender for Endpoint Indicators API, preventing access to all URLs under that domain across all managed endpoints.
Required Parameters
fqdn (fully qualified domain name)
API Endpoints
POST https://api.securitycenter.microsoft.com/api/indicators
Undo Action
No - Manual removal required
Required Permissions
Ti.ReadWrite or Ti.ReadWrite.All
Impact Level
High - Blocks domain access globally
Action: Block IP (Azure)
Blocks an IP address in Microsoft 365 using Azure AD Conditional Access. Creates or updates a named location with blocked IPs and ensures a conditional access policy blocks authentication attempts from that location.
Required Parameters
ip_address
API Endpoints
GET /identity/conditionalAccess/namedLocations (with filter)
POST /identity/conditionalAccess/namedLocations
PATCH /identity/conditionalAccess/namedLocations/${namedLocationID}
POST /identity/conditionalAccess/policies
Undo Action
No - Manual policy removal required
Required Permissions
Policy.Read.All, Policy.ReadWrite.ConditionalAccess, and Application.Read.All
Impact Level
High - Blocks authentication from IP
Mimecast Actions
Mimecast action connectors use the Mimecast API V2 to perform email security and threat protection actions. These actions are commonly used for email sender blocking, URL blocking, and threat containment during incident response. Mimecast provides cloud-based email security, archiving, and continuity services.
Primary use cases: Phishing sender blocking, malicious URL blocking, domain-based threat prevention
Note: The group radiantsecurity_blocked_senders is automatically created if it doesn't exist and is used for sender blocking policies.
Action: Block Sender
Blocks a specific email sender address in Mimecast by adding it to the "radiantsecurity_blocked_senders" group. The group is created automatically if it doesn't exist, along with the necessary blocked sender policy.
Required Parameters
email_from
API Endpoints
POST /api/directory/find-groups
POST /api/directory/create-group
POST /api/policy/blockedsenders/create-policy
POST /api/directory/add-group-member
Undo Action
No - Manual removal from group required
Required Permissions
Directories | Groups | All,
Gateway Menu | Policies | All
Directories Menu | Managed Senders | All (in case it exists on the UI), and
Gateway Menu | Managed Senders | All
Impact Level
Medium - Blocks sender for organization
Action: Block Sender Domain
Blocks an entire sender domain in Mimecast by adding it to the "radiantsecurity_blocked_senders" group. Extracts the domain from the email_from field and blocks all emails from that domain.
Required Parameters
email_from (domain is extracted from email address)
API Endpoints
POST /api/directory/find-groups
POST /api/directory/create-group
POST /api/policy/blockedsenders/create-policy
POST /api/directory/add-group-member
Undo Action
No - Manual removal from group required
Required Permissions
Directories | Groups | All,
Gateway Menu | Policies | All
Directories Menu | Managed Senders | All (in case it exists on the UI), and
Gateway Menu | Managed Senders | All
Impact Level
High - Blocks entire domain
Action: Block URL
Blocks a specific URL (exact path match) in Mimecast using Managed URLs. Creates a managed URL entry with action "block" that prevents users from accessing the exact URL.
Required Parameters
full_url
API Endpoints
POST /api/ttp/url/create-managed-url
Undo Action
No - Manual removal from managed URLs required
Required Permissions
Monitoring Menu | URL Protection | All
Impact Level
Medium - Blocks specific URL
Action: Block URL Domain
Blocks an entire URL domain (wildcard match) in Mimecast using Managed URLs. Creates a managed URL entry with matchType: "domain" that blocks access to all URLs under that domain.
Required Parameters
full_url (domain is extracted from URL)
API Endpoints
POST /api/ttp/url/create-managed-url (with matchType: "domain")
Undo Action
No - Manual removal from managed URLs required
Required Permissions
Monitoring Menu | URL Protection | All
Impact Level
High - Blocks entire domain
Netskope Actions
Netskope action connectors use the Netskope REST API v2 to perform cloud access security broker (CASB) and secure web gateway (SWG) actions. These actions are commonly used for URL blocking and web content filtering during incident response. Netskope provides cloud-native security for SaaS, IaaS, and web traffic.
Primary use cases: Malicious URL blocking, web threat containment
Action: Block URL
Blocks a specific URL in Netskope by adding it to the Radiant Security URL list.
Prerequisites: Requires the URL list "RADIANT_SECURITY_BLOCK_URL_POLICY" to be pre-created in Netskope Admin Console and configured in a Real-time Protection policy.
Required Parameters
full_url
API Endpoints
GET /api/v2/policy/urllist
PATCH /api/v2/policy/urllist/${urllistID}/append
POST /api/v2/policy/urllist/deploy
Undo Action
No - Manual removal from URL list required
Required Permissions
/api/v2/policy/urllist endpoints with Read and Write privilege
Impact Level
Medium - Blocks URL access
Okta Actions
Okta action connectors use the Okta Management API to perform identity and access management operations. These actions are commonly used for account security, session management, and network access control during incident response. Okta serves as a centralized identity provider for managing user authentication and authorization.
Primary use cases: User account lockdown, session termination, IP-based access control
Action: Disable Users and Terminate Active Sessions
Composite action that disables a user account and terminates all active sessions. This is a combination of disable_user and terminate_active_sessions actions, providing immediate account lockdown.
Required Parameters
user_principal_name, user_id, or service_account_id (user identifier)
API Endpoints
GET /api/v1/users/${userEmail}
POST /api/v1/users/${id}/lifecycle/suspend
DELETE /api/v1/users/${id}/sessions
Undo Action
Yes - via enable_user action
Required Permissions
okta.users.read, okta.users.manage, okta.users.userSessions.clear, and okta.users.lifecycle.suspend
Impact Level
High - User cannot access any systems
Action: Terminate Active Sessions
Terminates all active sessions for a user in Okta, forcing them to re-authenticate. The user account remains enabled but all existing sessions are invalidated.
Required Parameters
user_principal_name, user_id, or service_account_id (user identifier)
API Endpoints
GET /api/v1/users/${userEmail}
DELETE /api/v1/users/${id}/sessions
Undo Action
No - Sessions already terminated
Required Permissions
okta.users.read, okta.users.manage, and okta.users.userSessions.clear
Impact Level
Medium - User can re-authenticate
Action: Enable User
Enables a previously disabled user account in Okta, allowing them to sign in again. Use this to restore access after an incident has been resolved.
Required Parameters
user_principal_name, user_id, or service_account_id (user identifier)
API Endpoints
GET /api/v1/users/${userEmail}
POST /api/v1/users/${id}/lifecycle/unsuspend
Undo Action
Yes - via disable_users_and_terminate_active_sessions action
Required Permissions
okta.users.read, okta.users.manage, and okta.users.lifecycle.unsuspend
Impact Level
Low - Restores normal access
Action: Reset User Password
Resets a user's password in Okta and forces them to change it on next sign-in. The account is temporarily suspended and unsuspended to ensure password expiration takes effect.
Required Parameters
user_principal_name, user_id, or service_account_id (user identifier)
API Endpoints
GET /api/v1/users/${userEmail}
POST /api/v1/users/${id}/lifecycle/expire_password
POST /api/v1/users/${id}/lifecycle/suspend
POST /api/v1/users/${id}/lifecycle/unsuspend
Undo Action
No - Password already changed
Required Permissions
okta.users.read, okta.users.manage, okta.users.lifecycle.suspend, and okta.users.lifecycle.unsuspend
Impact Level
High - User must reset password
Action: Block IP
Blocks an IP address in Okta using Network Zones. Creates a dedicated network zone with the blocked IP and marks it as a blocklist. Each IP gets its own zone for granular control and easier management.
Required Parameters
ip_address
API Endpoints
POST /api/v1/zones
Undo Action
Yes - via unblock_ip action
Required Permissions
okta.networkZones.manage
Impact Level
High - Blocks access from IP globally
Action: Unblock IP
Unblocks a previously blocked IP address by deleting its network zone in Okta. This is an idempotent operation - if the network zone doesn't exist, it succeeds silently.
Required Parameters
ip_address
API Endpoints
GET /api/v1/zones
DELETE /api/v1/zones/${zoneId}
Undo Action
Yes - via block_ip action
Required Permissions
okta.networkZones.read, okta.networkZones.manage
Impact Level
Low - Restores IP access
Proofpoint Actions
Proofpoint action connectors use the Proofpoint API to perform email security and threat protection actions. These actions are commonly used for email sender blocking and spam prevention during incident response. Proofpoint provides advanced email security, threat intelligence, and compliance solutions.
Primary use cases: Malicious sender blocking, phishing prevention
Action: Block Sender
Blocks an email sender address in Proofpoint, preventing emails from that sender from being delivered to any user in the organization. Blocked senders are added to the organization's blocked sender list.
Required Parameters
email_from
API Endpoints
PATCH /api/v1/orgs/${domain}/sender-lists
Undo Action
No - Manual removal from sender list required
Required Permissions
Scope: admin-level access
Impact Level
Medium - Blocks sender for organization
SentinelOne Actions
SentinelOne action connectors use the SentinelOne Management Console API to perform endpoint protection and response actions. These actions are commonly used for endpoint containment, threat remediation, and malware blocking during incident response. SentinelOne provides autonomous endpoint protection with AI-driven threat detection.
Primary use cases: Endpoint isolation, malware scanning, file hash blocking
Action: Block File
Blocks a file by SHA1 hash on SentinelOne for all OS types (Windows, Linux, macOS). The file is blocked across all supported operating systems and all managed endpoints within the account.
Required Parameters
hash_sha1
API Endpoints
GET /web/api/v2.1/agents (to get accountId)
POST /web/api/v2.1/restrictions (called for each OS: windows, linux, macOS)
Undo Action
No - Vendor API does not support unblocking
Required Permissions
Blocklist: View, Edit, Delete, and Create
Impact Level
High - Blocks file across all endpoints
Action: Isolate Device
Isolates a device on SentinelOne, preventing it from communicating with other devices on the network. The device can still communicate with the SentinelOne management console for administration.
Required Parameters
device_id (SentinelOne device ID)
API Endpoints
POST /web/api/v2.1/agents/actions/disconnect
Undo Action
Yes - via release_device action
Required Permissions
Agents: Network Quarantine Control
Impact Level
High - Device network isolated
Action: Release Device
Releases a device from isolation on SentinelOne, restoring normal network communication.
Required Parameters
device_id (SentinelOne device ID)
API Endpoints
POST /web/api/v2.1/agents/actions/connect
Undo Action
Yes - via isolate_device action
Required Permissions
Agents: Network Quarantine Control
Impact Level
Low - Restores network access
Action: Run Full Disk Scan
Initiates a full disk scan on a device in SentinelOne to detect threats and malware. The scan runs in the background and may impact device performance.
Required Parameters
device_id (SentinelOne device ID)
API Endpoints
POST /web/api/v2.1/agents/actions/initiate-scan
Undo Action
No - Scan already initiated
Required Permissions
Agents: Initiate Scan
Impact Level
Low - Background scan process
Zscaler OneAPI Actions
Zscaler OneAPI action connectors use the Zscaler OneAPI framework to perform secure web gateway (SWG) actions against Zscaler Internet Access (ZIA). These actions are commonly used for malicious URL containment during phishing response. Zscaler provides cloud-based web security and zero-trust network access.
Primary use cases: Malicious URL blocking, phishing URL remediation
Note: The Zscaler connector requires a tenant on the Zscaler ZIdentity platform. Legacy NSS-based authentication is not supported.
Action: Block URL
Adds a URL to the Zscaler Advanced Threat Protection (ATP) policy denylist, blocking access across all managed endpoints. Uses the same endpoint as Unblock URL with the action query parameter set to ADD_TO_LIST.
Required Parameters
maliciousUrls (string array, in request body)
API Endpoints
PUT /zia/api/v1/cyberThreatProtection/maliciousUrls?action=ADD_TO_LIST
Undo Action
Yes - via unblock_url action
Required Permissions
Cyber Threat Protection: View, Edit
Impact Level
High - Blocks URL across all managed endpoints via ATP policy
Action: Unblock URL
Removes a URL from the Zscaler Advanced Threat Protection (ATP) policy denylist, restoring access across all managed endpoints. This is the reversal action for block_url.
Required Parameters
maliciousUrls (string array, in request body)
API Endpoints
PUT /zia/api/v1/cyberThreatProtection/maliciousUrls?action=REMOVE_FROM_LIST
Undo Action
Yes - via block_url action
Required Permissions
Cyber Threat Protection: View, Edit
Impact Level
Low - Restores URL access
Revert Capabilities
Understand revert capabilities
Revert capability determines if an action can be automatically reversed through the platform. Actions with revert support have a paired reversal action. For example, isolate_device can be undone with release_device, and disable_user can be reversed with enable_user. This gives you confidence to act decisively, knowing you can quickly restore normal operations.
How to reverse an action
If you need to undo a remediation step (for example, re-enabling a user after an investigation clears them), you can often do so directly from the same view.
Go to the table where you ran the action and find the affected artifact.
Click to open the right side drawer menu.
Look for the undo button in the Action history section.
Confirm to revert the action.
Some actions are inherently irreversible due to their nature or vendor API limitations. The Actions without revert support table lists why certain actions cannot be automatically reversed. For irreversible actions, we recommend extra caution and choosing less destructive alternatives when possible (e.g., soft delete instead of hard delete an email).
Actions with revert support
disable_users_and_
terminate_active_sessions
enable_user
Okta, MS365
enable_user
disable_users_and_
terminate_active_sessions
Okta, MS365
isolate_device
release_device
MS365 Defender, SentinelOne, CrowdStrike
release_device
isolate_device
MS365 Defender, SentinelOne, CrowdStrike
block_ip
unblock_ip
Okta
unblock_ip
block_ip
Okta
find_and_soft_delete_emails
restore_soft_deleted_emails
MS365
restore_soft_deleted_emails
find_and_soft_delete_emails
MS365
block_file
unblock_file
MS365
Defender
unblock_file
block_file
MS365
Defender
block_url
unblock_url
Zscaler
unblock_url
block_url
Zscaler
Actions without revert support
terminate_active_sessions
Sessions already terminated
Okta, MS365
reset_user_password
Password already changed
Okta, MS365
disable_all_forward_rules
Manual re-enablement required
MS365
delete_external_forward_rules
Rules permanently deleted
MS365
find_and_hard_delete_emails
Permanent deletion
MS365, Google Workspace
block_domain
Manual removal required
MS365 Defender
block_file
Vendor API does not support unblocking
SentinelOne, CrowdStrike
run_full_disk_scan
Scan already initiated
SentinelOne
block_url
Manual removal from URL list/managed URLs required
Netskope, Mimecast
block_url_domain
Manual removal from managed URLs required
Mimecast
block_sender
Manual removal from sender list/filters required
Proofpoint, Google Workspace, Mimecast
block_sender_domain
Manual removal from group required
Mimecast
block_ip
Manual policy removal required
MS365
enroll_in_phishing_training
Training enrollment cannot be undone
KnowBe4
Impact Level Definitions
High: Significant operational impact; requires immediate attention to restore.
Medium: Moderate operational impact; users can work around limitation.
Low: Minimal operational impact, easily reversible or limited to enrichment only.
Last updated
Was this helpful?