Response Actions

Understand the response actions that appear in your cases.

When you execute a response action during incident response, such as disabling a compromised user account or isolating an infected endpoint, it's essential to understand what that action does, which systems it affects, and whether it can safely be reversed.

This comprehensive reference guide documents all available response actions across your integrated security platforms, including their required parameters, API endpoints, impact levels, and - most importantly - their undo capabilities. Many actions can be automatically reversed with a single click, giving you full control to contain threats confidently and restore normal operations when incidents are resolved. Use this guide to make informed decisions during incident response and understand the full scope of each remediation action.

Prerequisites

• Before you can execute any response actions documented in this guide, you must have the appropriate action connectors configured and enabled in your environment.

Find your action connector

• CrowdStrike
• Google Workspace
• KnowBe4
• Microsoft 365
• Mimecast
• Netskope
• Okta
• Proofpoint
• SentinelOne
• Zscaler OneAPI

CrowdStrike Actions

CrowdStrike action connectors use the CrowdStrike Falcon API to perform endpoint detection and response (EDR) actions. These actions are commonly used for endpoint containment, threat intelligence, and indicator management during incident response. CrowdStrike Falcon provides cloud-native endpoint protection with real-time threat intelligence.

Primary use cases: Endpoint containment, custom IOC management, threat blocking

Action: Block File

Blocks a file by hash in CrowdStrike Falcon using custom Indicators of Compromise (IOCs). Supports SHA256, SHA1, and MD5 hashes. Blocked files are prevented from executing on all managed endpoints.

FIELD	DETAILS
Required Parameters	At least one of: hash_sha256, hash_sha1, or hash_md5
API Endpoints	POST /iocs/entities/indicators/v1
Undo Action	No
Required Permissions	IOCs (Indicators of Compromise): Write
Impact Level	High - Blocks file across all endpoints

Action: Isolate Device

Isolates a device in CrowdStrike Falcon, preventing it from communicating with other devices on the network.

FIELD	DETAILS
Required Parameters	device_id (Falcon sensor ID/AID)
API Endpoints	POST /devices/entities/devices-actions/v2?action_name=contain
Undo Action	Yes - via release_device action
Required Permissions	Hosts: Write
Impact Level	High - Device network isolated

Action: Release Device

Releases an isolated device in CrowdStrike Falcon (lift containment), restoring normal network communication.

FIELD	DETAILS
Required Parameters	device_id (Falcon sensor ID/AID)
API Endpoints	POST /devices/entities/devices-actions/v2?action_name=lift_containment
Undo Action	Yes - via isolate_device action
Required Permissions	Hosts: Write
Impact Level	Low - Restores network access

Google Workspace Actions

Google Workspace action connectors use the Google Workspace Admin SDK and Gmail API to perform email security and user management actions. These actions are commonly used for email threat remediation and sender blocking during incident response. Google Workspace provides cloud-based productivity and collaboration tools with integrated security controls.

Primary use cases: Phishing email removal, malicious sender blocking

Action: Block Sender

Blocks an email sender for all users with mailbox setup in the Google Workspace organization. Creates Gmail filters for each user that automatically deletes emails from the blocked sender.

FIELD	DETAILS
Required Parameters	email_from
API Endpoints	GET /admin/directory/v1/users (with customer: "my_customer") POST /gmail/v1/users/me/settings/filters
Undo Action	No - Manual filter removal required for each user
Required Permissions	https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/gmail.settings.basic
Impact Level	High - Affects all users in the organization

Action: Find and Soft Delete Emails

Finds emails matching sender and subject across all user mailboxes in Google Workspace and moves them to trash (soft delete). Emails remain in trash for 30 days before automatic permanent deletion. Uses Gmail search query with sender and subject criteria.

FIELD	DETAILS
Required Parameters	email_from, email_subject
API Endpoints	GET /admin/directory/v1/users (with customer: "my_customer") GET /gmail/v1/users/me/messages (with query) POST /gmail/v1/users/me/messages/${id}/trash
Undo Action	No - Manual recovery from trash required
Required Permissions	https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/gmail.modify
Impact Level	Medium - Emails can be recovered from trash

Action: Find and Hard Delete Emails

Finds emails matching sender and subject across all user mailboxes in Google Workspace and permanently deletes them (hard delete). This action bypasses trash and cannot be undone.

Warning: This action is irreversible. Use soft delete when possible.

FIELD	DETAILS
Required Parameters	email_from, email_subject
API Endpoints	GET /admin/directory/v1/users (with customer: "my_customer") GET /gmail/v1/users/me/messages (with query) DELETE /gmail/v1/users/me/messages/${id}
Undo Action	No - Permanent deletion
Required Permissions	https://www.googleapis.com/auth/admin.directory.user.readonly, and https://mail.google.com/
Impact Level	High - Irreversible action

KnowBe4 Actions

KnowBe4 action connectors use the KnowBe4 Reporting API to perform security awareness training actions. These actions are commonly used for phishing training enrollment and user education during and after security incidents. KnowBe4 provides security awareness training and simulated phishing campaigns.

Primary use cases: Post-incident training, phishing awareness education

Action: Enroll in Phishing Training

Enrolls a user in phishing training via KnowBe4. Uses the case number and user display name for context in the training enrollment event. This helps track training related to specific security incidents.

FIELD	DETAILS
Required Parameters	user_principal_name
API Endpoints	POST /events
Undo Action	No - Training enrollment cannot be undone
Required Permissions	User Event API: Write
Impact Level	Low - Educational action only

Microsoft 365 Actions

Microsoft 365 action connectors use Microsoft Graph API, Microsoft Defender for Endpoint API, and Exchange Online API to perform response actions across endpoints, email, identity, and security controls. These actions are commonly used for containment, remediation, and account protection during incident response. The connector integrates with multiple Microsoft security services including Azure AD, Exchange Online, and Microsoft Defender.

Primary use cases: Account compromise response, email security, endpoint containment, malware blocking

Action: Disable Users and Terminate Active Sessions

Composite action that disables a user account and revokes all sign-in sessions in Microsoft 365. This is a combination of disable_user and revoke_sign_in_sessions actions, providing immediate account lockdown across all Microsoft services.

FIELD	DETAILS
Required Parameters	user_principal_name, user_id, or service_account_id
API Endpoints	PATCH /users/${userIDorEmail} (with {accountEnabled: false}) POST /users/${userIDorEmail}/revokeSignInSessions
Undo Action	Yes - via enable_user action
Required Permissions	User.ReadWrite.All, User.RevokeSessions.All
Impact Level	High - User cannot access Microsoft 365 services

Action: Terminate Active Sessions

Required PermissionsRevokes all sign-in sessions for a user in Microsoft 365, forcing them to re-authenticate. The user account remains enabled but all refresh tokens are invalidated.

FIELD	DETAILS
Required Parameters	user_principal_name, user_id, or service_account_id
API Endpoints	POST /users/${userIDorEmail}/revokeSignInSessions
Undo Action	No - Sessions already terminated
Required Permissions	User.RevokeSessions.All
Impact Level	Medium - User can re-authenticate

Action: Enable User

Enables a previously disabled user account in Microsoft 365, allowing them to sign in again. Restores access to all Microsoft 365 services.

FIELD	DETAILS
Required Parameters	user_principal_name, user_id, or service_account_id
API Endpoints	PATCH /users/${userIDorEmail} (with {accountEnabled: true})
Undo Action	Yes - via disable_users_and_terminate_active_sessions action
Required Permissions	User.ReadWrite.All, User.EnableDisableAccount.All
Impact Level	Low - Restores normal access

Action: Reset User Password

Resets a user's password in Microsoft 365 and revokes all sign-in sessions, forcing them to change password on next sign-in.

FIELD	DETAILS
Required Parameters	user_principal_name, user_id, or service_account_id
API Endpoints	PATCH /users/${userIDorEmail} (with {passwordProfile: {forceChangePasswordNextSignIn: true}}) POST /users/${userIDorEmail}/revokeSignInSessions
Undo Action	No - Password already changed
Required Permissions	User.ReadWrite.All, User.RevokeSessions.All, User.EnableDisableAccount.All, andDirectory.AccessAsUser.All (delegated permission)
Impact Level	High - User must reset password

Action: Disable All Forward Rules

Disables all email forwarding rules for a user in Microsoft 365 Exchange Online. Rules remain configured but are set to inactive, preventing unauthorized email forwarding while preserving rule configurations.

FIELD	DETAILS
Required Parameters	user_principal_name
API Endpoints	GET /users/${userID}/mailFolders/inbox/messageRules PATCH /users/${userID}/mailFolders/inbox/messageRules/${ruleID} (with {isEnabled: false})
Undo Action	No - Manual re-enablement required
Required Permissions	MailboxSettings.ReadWrite
Impact Level	Medium - Stops email forwarding

Action: Delete External Forward Rules

Deletes all email forwarding rules that forward to external domains (domains not in the organization's verified domain list). Internal forwarding rules are preserved.

FIELD	DETAILS
Required Parameters	user_principal_name
API Endpoints	GET /domains GET /users/${userID}/mailFolders/inbox/messageRules DELETE /users/${userID}/mailFolders/inbox/messageRules/${ruleID}
Undo Action	No - Rules permanently deleted
Required Permissions	Domain.Read.All, MailboxSettings.ReadWrite
Impact Level	High - Permanently removes rules

Action: Find and Soft Delete Emails

Finds emails matching sender and subject in recipient mailboxes and moves them to the Deleted Items folder (soft delete). Emails can be recovered from Deleted Items. Searches each recipient's mailbox individually using sender + subject criteria.

FIELD	DETAILS
Required Parameters	email_from, email_subject, email_to (array of recipient email addresses)
API Endpoints	GET /domains GET /users/${userIDorEmail}/messages/ (with filter subject eq '...' and sender/emailAddress/address eq '...') POST /users/${userIDorEmail}/messages/${messageID}/move (with {destinationId: "deleteditems"})
Undo Action	Yes - via restore_soft_deleted_emails action
Required Permissions	Mail.ReadWrite
Impact Level	Low - Emails can be recovered

Action: Find and Hard Delete Emails

Finds emails matching sender and subject in recipient mailboxes and permanently deletes them (hard delete). This action bypasses the Deleted Items folder and cannot be undone.

Warning: This action is irreversible. Use soft delete when possible.

FIELD	DETAILS
Required Parameters	email_from, email_subject, email_to (array of recipient email addresses)
API Endpoints	GET /users/${userIDorEmail}/messages/ (with filter subject eq '...' and sender/emailAddress/address eq '...') DELETE /users/${userIDorEmail}/messages/${messageID}
Undo Action	No - Permanent deletion
Required Permissions	Mail.ReadWrite
Impact Level	High - Irreversible action

Action: Restore Soft Deleted Emails

Restores soft-deleted emails from the Deleted Items folder back to the recipient's inbox. This is the reversal action for find_and_soft_delete_emails.

FIELD	DETAILS
Required Parameters	email_from, email_subject, email_to (array of recipient email addresses)
API Endpoints	GET /users/${userIDorEmail}/mailFolders/deleteditems/messages/ (with filter) POST /users/${userIDorEmail}/messages/${messageID}/move (with {destinationId: "inbox"})
Undo Action	Yes - via find_and_soft_delete_emails action
Required Permissions	Mail.ReadWrite
Impact Level	Low - Restores emails

Action: Isolate Device

Isolates a device using Microsoft Defender for Endpoint, preventing it from communicating with other devices on the network. The device can still communicate with Defender services for management.

FIELD	DETAILS
Required Parameters	device_id (Defender sensor ID)
API Endpoints	POST https://api.securitycenter.microsoft.com/api/machines/${sensorID}/isolate
Undo Action	Yes - via release_device action
Required Permissions	Machine.Isolate
Impact Level	High - Device network isolated

Action: Release Device

Releases a device from isolation in Microsoft Defender for Endpoint, restoring normal network communication.

FIELD	DETAILS
Required Parameters	device_id (Defender sensor ID)
API Endpoints	POST https://api.securitycenter.microsoft.com/api/machines/${sensorID}/unisolate
Undo Action	Yes - via isolate_device action
Required Permissions	Machine.Isolate
Impact Level	Low - Restores network access

Action: Block File

Blocks a file by hash using Microsoft Defender for Endpoint Indicators API. Supports SHA256, SHA1, and MD5 hashes with priority: SHA256 > SHA1 > MD5. Blocked files are prevented from executing across all managed endpoints.

FIELD	DETAILS
Required Parameters	file_name, and at least one of: hash_sha256, hash_sha1, or hash_md5
API Endpoints	POST https://api.securitycenter.microsoft.com/api/indicators
Undo Action	Yes - via unblock_file action
Required Permissions	Ti.ReadWrite or Ti.ReadWrite.All
Impact Level	High - Blocks file execution globally

Action: Unblock File

Unblocks a previously blocked file by removing its indicator from Microsoft Defender for Endpoint. This is the reversal action for block_file.

FIELD	DETAILS
Required Parameters	file_name, and at least one of: hash_sha256, hash_sha1, or hash_md5
API Endpoints	GET https://api.securitycenter.microsoft.com/api/indicators (with filter) DELETE https://api.securitycenter.microsoft.com/api/indicators/${indicatorID}
Undo Action	Yes - via block_file action
Required Permissions	Ti.ReadWrite or Ti.ReadWrite.All
Impact Level	Low - Removes file block

Action: Block Domain

Blocks a domain using Microsoft Defender for Endpoint Indicators API, preventing access to all URLs under that domain across all managed endpoints.

FIELD	DETAILS
Required Parameters	fqdn (fully qualified domain name)
API Endpoints	POST https://api.securitycenter.microsoft.com/api/indicators
Undo Action	No - Manual removal required
Required Permissions	Ti.ReadWrite or Ti.ReadWrite.All
Impact Level	High - Blocks domain access globally

Action: Block IP (Azure)

Blocks an IP address in Microsoft 365 using Azure AD Conditional Access. Creates or updates a named location with blocked IPs and ensures a conditional access policy blocks authentication attempts from that location.

FIELD	DETAILS
Required Parameters	ip_address
API Endpoints	GET /identity/conditionalAccess/namedLocations (with filter) POST /identity/conditionalAccess/namedLocations PATCH /identity/conditionalAccess/namedLocations/${namedLocationID} POST /identity/conditionalAccess/policies
Undo Action	No - Manual policy removal required
Required Permissions	Policy.Read.All, Policy.ReadWrite.ConditionalAccess, and Application.Read.All
Impact Level	High - Blocks authentication from IP

Mimecast Actions

Mimecast action connectors use the Mimecast API V2 to perform email security and threat protection actions. These actions are commonly used for email sender blocking, URL blocking, and threat containment during incident response. Mimecast provides cloud-based email security, archiving, and continuity services.

Primary use cases: Phishing sender blocking, malicious URL blocking, domain-based threat prevention

Note: The group radiantsecurity_blocked_senders is automatically created if it doesn't exist and is used for sender blocking policies.

Action: Block Sender

Blocks a specific email sender address in Mimecast by adding it to the "radiantsecurity_blocked_senders" group. The group is created automatically if it doesn't exist, along with the necessary blocked sender policy.

FIELD	DETAILS
Required Parameters	email_from
API Endpoints	POST /api/directory/find-groups POST /api/directory/create-group POST /api/policy/blockedsenders/create-policy POST /api/directory/add-group-member
Undo Action	No - Manual removal from group required
Required Permissions	Directories | Groups | All, Gateway Menu | Policies | All Directories Menu | Managed Senders | All (in case it exists on the UI), and Gateway Menu | Managed Senders | All
Impact Level	Medium - Blocks sender for organization

Action: Block Sender Domain

Blocks an entire sender domain in Mimecast by adding it to the "radiantsecurity_blocked_senders" group. Extracts the domain from the email_from field and blocks all emails from that domain.

FIELD	DETAILS
Required Parameters	email_from (domain is extracted from email address)
API Endpoints	POST /api/directory/find-groups POST /api/directory/create-group POST /api/policy/blockedsenders/create-policy POST /api/directory/add-group-member
Undo Action	No - Manual removal from group required
Required Permissions	Directories | Groups | All, Gateway Menu | Policies | All Directories Menu | Managed Senders | All (in case it exists on the UI), and Gateway Menu | Managed Senders | All
Impact Level	High - Blocks entire domain

Action: Block URL

Blocks a specific URL (exact path match) in Mimecast using Managed URLs. Creates a managed URL entry with action "block" that prevents users from accessing the exact URL.

FIELD	DETAILS
Required Parameters	full_url
API Endpoints	POST /api/ttp/url/create-managed-url
Undo Action	No - Manual removal from managed URLs required
Required Permissions	Monitoring Menu | URL Protection | All
Impact Level	Medium - Blocks specific URL

Action: Block URL Domain

Blocks an entire URL domain (wildcard match) in Mimecast using Managed URLs. Creates a managed URL entry with matchType: "domain" that blocks access to all URLs under that domain.

FIELD	DETAILS
Required Parameters	full_url (domain is extracted from URL)
API Endpoints	POST /api/ttp/url/create-managed-url (with matchType: "domain")
Undo Action	No - Manual removal from managed URLs required
Required Permissions	Monitoring Menu | URL Protection | All
Impact Level	High - Blocks entire domain

Netskope Actions

Netskope action connectors use the Netskope REST API v2 to perform cloud access security broker (CASB) and secure web gateway (SWG) actions. These actions are commonly used for URL blocking and web content filtering during incident response. Netskope provides cloud-native security for SaaS, IaaS, and web traffic.

Primary use cases: Malicious URL blocking, web threat containment

Action: Block URL

Blocks a specific URL in Netskope by adding it to the Radiant Security URL list.

Prerequisites: Requires the URL list "RADIANT_SECURITY_BLOCK_URL_POLICY" to be pre-created in Netskope Admin Console and configured in a Real-time Protection policy.

FIELD	DETAILS
Required Parameters	full_url
API Endpoints	GET /api/v2/policy/urllist PATCH /api/v2/policy/urllist/${urllistID}/append POST /api/v2/policy/urllist/deploy
Undo Action	No - Manual removal from URL list required
Required Permissions	/api/v2/policy/urllist endpoints with Read and Write privilege
Impact Level	Medium - Blocks URL access

Okta Actions

Okta action connectors use the Okta Management API to perform identity and access management operations. These actions are commonly used for account security, session management, and network access control during incident response. Okta serves as a centralized identity provider for managing user authentication and authorization.

Primary use cases: User account lockdown, session termination, IP-based access control

Action: Disable Users and Terminate Active Sessions

Composite action that disables a user account and terminates all active sessions. This is a combination of disable_user and terminate_active_sessions actions, providing immediate account lockdown.

FIELD	DETAILS
Required Parameters	user_principal_name, user_id, or service_account_id (user identifier)
API Endpoints	GET /api/v1/users/${userEmail} POST /api/v1/users/${id}/lifecycle/suspend DELETE /api/v1/users/${id}/sessions
Undo Action	Yes - via enable_user action
Required Permissions	okta.users.read, okta.users.manage, okta.users.userSessions.clear, and okta.users.lifecycle.suspend
Impact Level	High - User cannot access any systems

Action: Terminate Active Sessions

Terminates all active sessions for a user in Okta, forcing them to re-authenticate. The user account remains enabled but all existing sessions are invalidated.

FIELD	DETAILS
Required Parameters	user_principal_name, user_id, or service_account_id (user identifier)
API Endpoints	GET /api/v1/users/${userEmail} DELETE /api/v1/users/${id}/sessions
Undo Action	No - Sessions already terminated
Required Permissions	okta.users.read, okta.users.manage, and okta.users.userSessions.clear
Impact Level	Medium - User can re-authenticate

Action: Enable User

Enables a previously disabled user account in Okta, allowing them to sign in again. Use this to restore access after an incident has been resolved.

FIELD	DETAILS
Required Parameters	user_principal_name, user_id, or service_account_id (user identifier)
API Endpoints	GET /api/v1/users/${userEmail} POST /api/v1/users/${id}/lifecycle/unsuspend
Undo Action	Yes - via disable_users_and_terminate_active_sessions action
Required Permissions	okta.users.read, okta.users.manage, and okta.users.lifecycle.unsuspend
Impact Level	Low - Restores normal access

Action: Reset User Password

Resets a user's password in Okta and forces them to change it on next sign-in. The account is temporarily suspended and unsuspended to ensure password expiration takes effect.

FIELD	DETAILS
Required Parameters	user_principal_name, user_id, or service_account_id (user identifier)
API Endpoints	GET /api/v1/users/${userEmail} POST /api/v1/users/${id}/lifecycle/expire_password POST /api/v1/users/${id}/lifecycle/suspend POST /api/v1/users/${id}/lifecycle/unsuspend
Undo Action	No - Password already changed
Required Permissions	okta.users.read, okta.users.manage, okta.users.lifecycle.suspend, and okta.users.lifecycle.unsuspend
Impact Level	High - User must reset password

Action: Block IP

Blocks an IP address in Okta using Network Zones. Creates a dedicated network zone with the blocked IP and marks it as a blocklist. Each IP gets its own zone for granular control and easier management.

FIELD	DETAILS
Required Parameters	ip_address
API Endpoints	POST /api/v1/zones
Undo Action	Yes - via unblock_ip action
Required Permissions	okta.networkZones.manage
Impact Level	High - Blocks access from IP globally

Action: Unblock IP

Unblocks a previously blocked IP address by deleting its network zone in Okta. This is an idempotent operation - if the network zone doesn't exist, it succeeds silently.

FIELD	DETAILS
Required Parameters	ip_address
API Endpoints	GET /api/v1/zones DELETE /api/v1/zones/${zoneId}
Undo Action	Yes - via block_ip action
Required Permissions	okta.networkZones.read, okta.networkZones.manage
Impact Level	Low - Restores IP access

Proofpoint Actions

Proofpoint action connectors use the Proofpoint API to perform email security and threat protection actions. These actions are commonly used for email sender blocking and spam prevention during incident response. Proofpoint provides advanced email security, threat intelligence, and compliance solutions.

Primary use cases: Malicious sender blocking, phishing prevention

Action: Block Sender

Blocks an email sender address in Proofpoint, preventing emails from that sender from being delivered to any user in the organization. Blocked senders are added to the organization's blocked sender list.

FIELD	DETAILS
Required Parameters	email_from
API Endpoints	PATCH /api/v1/orgs/${domain}/sender-lists
Undo Action	No - Manual removal from sender list required
Required Permissions	Scope: admin-level access
Impact Level	Medium - Blocks sender for organization

SentinelOne Actions

SentinelOne action connectors use the SentinelOne Management Console API to perform endpoint protection and response actions. These actions are commonly used for endpoint containment, threat remediation, and malware blocking during incident response. SentinelOne provides autonomous endpoint protection with AI-driven threat detection.

Primary use cases: Endpoint isolation, malware scanning, file hash blocking

Action: Block File

Blocks a file by SHA1 hash on SentinelOne for all OS types (Windows, Linux, macOS). The file is blocked across all supported operating systems and all managed endpoints within the account.

FIELD	DETAILS
Required Parameters	hash_sha1
API Endpoints	GET /web/api/v2.1/agents (to get accountId) POST /web/api/v2.1/restrictions (called for each OS: windows, linux, macOS)
Undo Action	No - Vendor API does not support unblocking
Required Permissions	Blocklist: View, Edit, Delete, and Create
Impact Level	High - Blocks file across all endpoints

Action: Isolate Device

Isolates a device on SentinelOne, preventing it from communicating with other devices on the network. The device can still communicate with the SentinelOne management console for administration.

FIELD	DETAILS
Required Parameters	device_id (SentinelOne device ID)
API Endpoints	POST /web/api/v2.1/agents/actions/disconnect
Undo Action	Yes - via release_device action
Required Permissions	Agents: Network Quarantine Control
Impact Level	High - Device network isolated

Action: Release Device

Releases a device from isolation on SentinelOne, restoring normal network communication.

FIELD	DETAILS
Required Parameters	device_id (SentinelOne device ID)
API Endpoints	POST /web/api/v2.1/agents/actions/connect
Undo Action	Yes - via isolate_device action
Required Permissions	Agents: Network Quarantine Control
Impact Level	Low - Restores network access

Action: Run Full Disk Scan

Initiates a full disk scan on a device in SentinelOne to detect threats and malware. The scan runs in the background and may impact device performance.

FIELD	DETAILS
Required Parameters	device_id (SentinelOne device ID)
API Endpoints	POST /web/api/v2.1/agents/actions/initiate-scan
Undo Action	No - Scan already initiated
Required Permissions	Agents: Initiate Scan
Impact Level	Low - Background scan process

Zscaler OneAPI Actions

Zscaler OneAPI action connectors use the Zscaler OneAPI framework to perform secure web gateway (SWG) actions against Zscaler Internet Access (ZIA). These actions are commonly used for malicious URL containment during phishing response. Zscaler provides cloud-based web security and zero-trust network access.

Primary use cases: Malicious URL blocking, phishing URL remediation

Note: The Zscaler connector requires a tenant on the Zscaler ZIdentity platform. Legacy NSS-based authentication is not supported.

Action: Block URL

Adds a URL to the Zscaler Advanced Threat Protection (ATP) policy denylist, blocking access across all managed endpoints. Uses the same endpoint as Unblock URL with the action query parameter set to ADD_TO_LIST.

FIELD	DETAILS
Required Parameters	maliciousUrls (string array, in request body)
API Endpoints	PUT /zia/api/v1/cyberThreatProtection/maliciousUrls?action=ADD_TO_LIST
Undo Action	Yes - via unblock_url action
Required Permissions	Cyber Threat Protection: View, Edit
Impact Level	High - Blocks URL across all managed endpoints via ATP policy

Action: Unblock URL

Removes a URL from the Zscaler Advanced Threat Protection (ATP) policy denylist, restoring access across all managed endpoints. This is the reversal action for block_url.

FIELD	DETAILS
Required Parameters	maliciousUrls (string array, in request body)
API Endpoints	PUT /zia/api/v1/cyberThreatProtection/maliciousUrls?action=REMOVE_FROM_LIST
Undo Action	Yes - via block_url action
Required Permissions	Cyber Threat Protection: View, Edit
Impact Level	Low - Restores URL access

Revert Capabilities

Understand revert capabilities

Revert capability determines if an action can be automatically reversed through the platform. Actions with revert support have a paired reversal action. For example, isolate_device can be undone with release_device, and disable_user can be reversed with enable_user. This gives you confidence to act decisively, knowing you can quickly restore normal operations.

How to reverse an action

If you need to undo a remediation step (for example, re-enabling a user after an investigation clears them), you can often do so directly from the same view.

1. Go to the table where you ran the action and find the affected artifact.
2. Click to open the right side drawer menu.
3. Look for the undo button in the Action history section.
4. Confirm to revert the action.

Some actions are inherently irreversible due to their nature or vendor API limitations. The Actions without revert support table lists why certain actions cannot be automatically reversed. For irreversible actions, we recommend extra caution and choosing less destructive alternatives when possible (e.g., soft delete instead of hard delete an email).

1

Actions with revert support

Action	Reversal Action	Vendors
disable_users_and_ terminate_active_sessions	enable_user	Okta, MS365
enable_user	disable_users_and_ terminate_active_sessions	Okta, MS365
isolate_device	release_device	MS365 Defender, SentinelOne, CrowdStrike
release_device	isolate_device	MS365 Defender, SentinelOne, CrowdStrike
block_ip	unblock_ip	Okta
unblock_ip	block_ip	Okta
find_and_soft_delete_emails	restore_soft_deleted_emails	MS365
restore_soft_deleted_emails	find_and_soft_delete_emails	MS365
block_file	unblock_file	MS365 Defender
unblock_file	block_file	MS365 Defender
block_url	unblock_url	Zscaler
unblock_url	block_url	Zscaler

2

Actions without revert support

Action	Reason	Vendors
terminate_active_sessions	Sessions already terminated	Okta, MS365
reset_user_password	Password already changed	Okta, MS365
disable_all_forward_rules	Manual re-enablement required	MS365
delete_external_forward_rules	Rules permanently deleted	MS365
find_and_hard_delete_emails	Permanent deletion	MS365, Google Workspace
block_domain	Manual removal required	MS365 Defender
block_file	Vendor API does not support unblocking	SentinelOne, CrowdStrike
run_full_disk_scan	Scan already initiated	SentinelOne
block_url	Manual removal from URL list/managed URLs required	Netskope, Mimecast
block_url_domain	Manual removal from managed URLs required	Mimecast
block_sender	Manual removal from sender list/filters required	Proofpoint, Google Workspace, Mimecast
block_sender_domain	Manual removal from group required	Mimecast
block_ip	Manual policy removal required	MS365
enroll_in_phishing_training	Training enrollment cannot be undone	KnowBe4

Impact Level Definitions

• High: Significant operational impact; requires immediate attention to restore.
• Medium: Moderate operational impact; users can work around limitation.
• Low: Minimal operational impact, easily reversible or limited to enrichment only.