# Response Actions

When you execute a [response action](https://help.radiantsecurity.ai/radiant-cases/radiant-cases/response-actions-in-cases) during incident response, such as disabling a compromised user account or isolating an infected endpoint, it's essential to understand what that action does, which systems it affects, and whether it can safely be reversed. 

This comprehensive reference guide documents all available response actions across your integrated security platforms, including their required parameters, API endpoints, impact levels, and - most importantly - their undo capabilities. Many actions can be automatically reversed with a single click, giving you full control to contain threats confidently and restore normal operations when incidents are resolved. Use this guide to make informed decisions during incident response and understand the full scope of each remediation action.

### Prerequisites

* [ ] Before you can execute any response actions documented in this guide, you must have the appropriate action connectors configured and enabled in your environment.

### Find your action connector

* [CrowdStrike](#crowdstrike-actions)
* [Google Workspace](#google-workspace-actions)
* [KnowBe4](#knowbe4-actions)
* [Microsoft 365](#microsoft-365-actions)
* [Mimecast](#mimecast-actions)
* [Netskope](#netskope-actions)
* [Okta](#okta-actions)
* [Proofpoint](#proofpoint-actions)
* [SentinelOne](#sentinelone-actions)

### CrowdStrike Actions

CrowdStrike action connectors use the **CrowdStrike Falcon API** to perform endpoint detection and response (EDR) actions. These actions are commonly used for **endpoint containment, threat intelligence, and indicator management** during incident response. CrowdStrike Falcon provides cloud-native endpoint protection with real-time threat intelligence.

> **Primary use cases:** Endpoint containment, custom IOC management, threat blocking

<details>

<summary>Action: Block File</summary>

Blocks a file by hash in CrowdStrike Falcon using custom Indicators of Compromise (IOCs). Supports SHA256, SHA1, and MD5 hashes. Blocked files are prevented from executing on all managed endpoints.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td>At least one of: <code>hash_sha256</code>, <code>hash_sha1</code>, or <code>hash_md5</code></td></tr><tr><td>API Endpoints</td><td><code>POST /iocs/entities/indicators/v1</code></td></tr><tr><td>Undo Action</td><td>No</td></tr><tr><td>Required Permissions</td><td><code>IOCs (Indicators of Compromise): Write</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Blocks file across all endpoints</td></tr></tbody></table>

</details>

<details>

<summary>Action: Isolate Device</summary>

Isolates a device in CrowdStrike Falcon, preventing it from communicating with other devices on the network.&#x20;

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>device_id</code> (Falcon sensor ID/AID)</td></tr><tr><td>API Endpoints</td><td><code>POST /devices/entities/devices-actions/v2?action_name=contain</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>release_device</code> action</td></tr><tr><td>Required Permissions</td><td><code>Hosts: Write</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Device network isolated</td></tr></tbody></table>

</details>

<details>

<summary>Action: Release Device</summary>

Releases an isolated device in CrowdStrike Falcon (lift containment), restoring normal network communication.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>device_id</code> (Falcon sensor ID/AID)</td></tr><tr><td>API Endpoints</td><td><code>POST /devices/entities/devices-actions/v2?action_name=lift_containment</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>isolate_device</code> action</td></tr><tr><td>Required Permissions</td><td><code>Hosts: Write</code></td></tr><tr><td>Impact Level</td><td><mark style="color:green;">Low</mark> - Restores network access</td></tr></tbody></table>

</details>

### Google Workspace Actions

Google Workspace action connectors use the **Google Workspace Admin SDK** and **Gmail API** to perform email security and user management actions. These actions are commonly used for **email threat remediation and sender blocking** during incident response. Google Workspace provides cloud-based productivity and collaboration tools with integrated security controls.

> **Primary use cases:** Phishing email removal, malicious sender blocking

<details>

<summary>Action: Block Sender</summary>

Blocks an email sender for all users with mailbox setup in the Google Workspace organization. Creates Gmail filters for each user that automatically deletes emails from the blocked sender.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>email_from</code></td></tr><tr><td>API Endpoints</td><td><code>GET /admin/directory/v1/users</code> (with <code>customer: "my_customer"</code>)<br><code>POST /gmail/v1/users/me/settings/filters</code></td></tr><tr><td>Undo Action</td><td>No - Manual filter removal required for each user</td></tr><tr><td>Required Permissions</td><td><code>https://www.googleapis.com/auth/admin.directory.user.readonly</code>, <code>https://www.googleapis.com/auth/gmail.settings.basic</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Affects all users in the organization</td></tr></tbody></table>

</details>

<details>

<summary>Action: Find and Soft Delete Emails</summary>

Finds emails matching sender and subject across all user mailboxes in Google Workspace and moves them to trash (soft delete). Emails remain in trash for 30 days before automatic permanent deletion. Uses Gmail search query with sender and subject criteria.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>email_from</code>, <code>email_subject</code></td></tr><tr><td>API Endpoints</td><td><code>GET /admin/directory/v1/users</code> (with <code>customer: "my_customer"</code>)<br><code>GET /gmail/v1/users/me/messages</code> (with query)<br><code>POST /gmail/v1/users/me/messages/${id}/trash</code></td></tr><tr><td>Undo Action</td><td>No - Manual recovery from trash required</td></tr><tr><td>Required Permissions</td><td><code>https://www.googleapis.com/auth/admin.directory.user.readonly</code>, <code>https://www.googleapis.com/auth/gmail.modify</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$warning;">Medium</mark> - Emails can be recovered from trash</td></tr></tbody></table>

</details>

<details>

<summary>Action: Find and Hard Delete Emails</summary>

Finds emails matching sender and subject across all user mailboxes in Google Workspace and permanently deletes them (hard delete). This action bypasses trash and cannot be undone.

{% hint style="danger" %}
**Warning:** This action is **irreversible**. Use soft delete when possible.
{% endhint %}

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>email_from</code>, <code>email_subject</code></td></tr><tr><td>API Endpoints</td><td><code>GET /admin/directory/v1/users</code> (with <code>customer: "my_customer"</code>)<br><code>GET /gmail/v1/users/me/messages</code> (with query)<br><code>DELETE /gmail/v1/users/me/messages/${id}</code></td></tr><tr><td>Undo Action</td><td>No - Permanent deletion</td></tr><tr><td>Required Permissions</td><td><code>https://www.googleapis.com/auth/admin.directory.user.readonly</code>, and <code>https://mail.google.com/</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Irreversible action</td></tr></tbody></table>

</details>

### KnowBe4 Actions

KnowBe4 action connectors use the **KnowBe4 Reporting API** to perform security awareness training actions. These actions are commonly used for **phishing training enrollment and user education** during and after security incidents. KnowBe4 provides security awareness training and simulated phishing campaigns.

> **Primary use cases:** Post-incident training, phishing awareness education

<details>

<summary>Action: Enroll in Phishing Training</summary>

Enrolls a user in phishing training via KnowBe4. Uses the case number and user display name for context in the training enrollment event. This helps track training related to specific security incidents.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>user_principal_name</code></td></tr><tr><td>API Endpoints</td><td><code>POST /events</code></td></tr><tr><td>Undo Action</td><td>No - Training enrollment cannot be undone</td></tr><tr><td>Required Permissions</td><td><code>User Event API: Write</code></td></tr><tr><td>Impact Level</td><td><mark style="color:green;">Low</mark> - Educational action only</td></tr></tbody></table>

</details>

### Microsoft 365 Actions

Microsoft 365 action connectors use **Microsoft Graph API**, **Microsoft Defender for Endpoint API**, and **Exchange Online API** to perform response actions across endpoints, email, identity, and security controls. These actions are commonly used for **containment, remediation, and account protection** during incident response. The connector integrates with multiple Microsoft security services including Azure AD, Exchange Online, and Microsoft Defender.

> **Primary use cases:** Account compromise response, email security, endpoint containment, malware blocking

<details>

<summary>Action: Disable Users and Terminate Active Sessions</summary>

Composite action that disables a user account and revokes all sign-in sessions in Microsoft 365. This is a combination of `disable_user` and `revoke_sign_in_sessions` actions, providing immediate account lockdown across all Microsoft services.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>user_principal_name</code>, <code>user_id</code>, or <code>service_account_id</code></td></tr><tr><td>API Endpoints</td><td><code>PATCH /users/${userIDorEmail}</code> (with <code>{accountEnabled: false}</code>)<br><code>POST /users/${userIDorEmail}/revokeSignInSessions</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>enable_user</code> action</td></tr><tr><td>Required Permissions</td><td><code>User.ReadWrite.All</code>, <code>User.RevokeSessions.All</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - User cannot access Microsoft 365 services</td></tr></tbody></table>

</details>

<details>

<summary>Action: Terminate Active Sessions</summary>

Required PermissionsRevokes all sign-in sessions for a user in Microsoft 365, forcing them to re-authenticate. The user account remains enabled but all refresh tokens are invalidated.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>user_principal_name</code>, <code>user_id</code>, or <code>service_account_id</code></td></tr><tr><td>API Endpoints</td><td><code>POST /users/${userIDorEmail}/revokeSignInSessions</code></td></tr><tr><td>Undo Action</td><td>No - Sessions already terminated</td></tr><tr><td>Required Permissions</td><td><code>User.RevokeSessions.All</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$warning;">Medium</mark> - User can re-authenticate</td></tr></tbody></table>

</details>

<details>

<summary>Action: Enable User</summary>

Enables a previously disabled user account in Microsoft 365, allowing them to sign in again. Restores access to all Microsoft 365 services.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>user_principal_name</code>, <code>user_id</code>, or <code>service_account_id</code></td></tr><tr><td>API Endpoints</td><td><code>PATCH /users/${userIDorEmail}</code> (with <code>{accountEnabled: true}</code>)</td></tr><tr><td>Undo Action</td><td>Yes - via <code>disable_users_and_terminate_active_sessions</code> action</td></tr><tr><td>Required Permissions</td><td><code>User.ReadWrite.All</code>, <code>User.EnableDisableAccount.All</code></td></tr><tr><td>Impact Level</td><td><mark style="color:green;">Low</mark> - Restores normal access</td></tr></tbody></table>

</details>

<details>

<summary>Action: Reset User Password</summary>

Resets a user's password in Microsoft 365 and revokes all sign-in sessions, forcing them to change password on next sign-in.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>user_principal_name</code>, <code>user_id</code>, or <code>service_account_id</code></td></tr><tr><td>API Endpoints</td><td><code>PATCH /users/${userIDorEmail}</code> (with <code>{passwordProfile: {forceChangePasswordNextSignIn: true}}</code>)<br><code>POST /users/${userIDorEmail}/revokeSignInSessions</code></td></tr><tr><td>Undo Action</td><td>No - Password already changed</td></tr><tr><td>Required Permissions</td><td><code>User.ReadWrite.All</code>, <code>User.RevokeSessions.All</code>, <code>User.EnableDisableAccount.All</code>, and<code>Directory.AccessAsUser.All (delegated permission)</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - User must reset password</td></tr></tbody></table>

</details>

<details>

<summary>Action: Disable All Forward Rules</summary>

Disables all email forwarding rules for a user in Microsoft 365 Exchange Online. Rules remain configured but are set to inactive, preventing unauthorized email forwarding while preserving rule configurations.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>user_principal_name</code></td></tr><tr><td>API Endpoints</td><td><code>GET /users/${userID}/mailFolders/inbox/messageRules</code><br><code>PATCH /users/${userID}/mailFolders/inbox/messageRules/${ruleID}</code> (with <code>{isEnabled: false}</code>)</td></tr><tr><td>Undo Action</td><td>No - Manual re-enablement required</td></tr><tr><td>Required Permissions</td><td><code>MailboxSettings.ReadWrite</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$warning;">Medium</mark> - Stops email forwarding</td></tr></tbody></table>

</details>

<details>

<summary>Action: Delete External Forward Rules</summary>

Deletes all email forwarding rules that forward to external domains (domains not in the organization's verified domain list). Internal forwarding rules are preserved.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>user_principal_name</code></td></tr><tr><td>API Endpoints</td><td><code>GET /domains</code><br><code>GET /users/${userID}/mailFolders/inbox/messageRules</code><br><code>DELETE /users/${userID}/mailFolders/inbox/messageRules/${ruleID}</code></td></tr><tr><td>Undo Action</td><td>No - Rules permanently deleted</td></tr><tr><td>Required Permissions</td><td><code>Domain.Read.All</code>, <code>MailboxSettings.ReadWrite</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Permanently removes rules</td></tr></tbody></table>

</details>

<details>

<summary>Action: Find and Soft Delete Emails</summary>

Finds emails matching sender and subject in recipient mailboxes and moves them to the Deleted Items folder (soft delete). Emails can be recovered from Deleted Items. Searches each recipient's mailbox individually using sender + subject criteria.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>email_from</code>, <code>email_subject</code>, <code>email_to</code> (array of recipient email addresses)</td></tr><tr><td>API Endpoints</td><td><code>GET /domains</code><br><code>GET /users/${userIDorEmail}/messages/</code> (with filter <code>subject eq '...' and sender/emailAddress/address eq '...'</code>)<br><code>POST /users/${userIDorEmail}/messages/${messageID}/move</code> (with <code>{destinationId: "deleteditems"}</code>)</td></tr><tr><td>Undo Action</td><td>Yes - via <code>restore_soft_deleted_emails</code> action</td></tr><tr><td>Required Permissions</td><td><code>Mail.ReadWrite</code></td></tr><tr><td>Impact Level</td><td>Low - Emails can be recovered</td></tr></tbody></table>

</details>

<details>

<summary>Action: Find and Hard Delete Emails</summary>

Finds emails matching sender and subject in recipient mailboxes and permanently deletes them (hard delete). This action bypasses the Deleted Items folder and cannot be undone.

{% hint style="danger" %}
**Warning:** This action is **irreversible**. Use soft delete when possible.
{% endhint %}

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>email_from</code>, <code>email_subject</code>, <code>email_to</code> (array of recipient email addresses)</td></tr><tr><td>API Endpoints</td><td><code>GET /users/${userIDorEmail}/messages/</code> (with filter <code>subject eq '...' and sender/emailAddress/address eq '...'</code>)<br><code>DELETE /users/${userIDorEmail}/messages/${messageID}</code></td></tr><tr><td>Undo Action</td><td>No - Permanent deletion</td></tr><tr><td>Required Permissions</td><td><code>Mail.ReadWrite</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Irreversible action</td></tr></tbody></table>

</details>

<details>

<summary>Action: Restore Soft Deleted Emails</summary>

Restores soft-deleted emails from the Deleted Items folder back to the recipient's inbox. This is the reversal action for `find_and_soft_delete_emails`.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>email_from</code>, <code>email_subject</code>, <code>email_to</code> (array of recipient email addresses)</td></tr><tr><td>API Endpoints</td><td><code>GET /users/${userIDorEmail}/mailFolders/deleteditems/messages/</code> (with filter)<br><code>POST /users/${userIDorEmail}/messages/${messageID}/move</code> (with <code>{destinationId: "inbox"}</code>)</td></tr><tr><td>Undo Action</td><td>Yes - via <code>find_and_soft_delete_emails</code> action</td></tr><tr><td>Required Permissions</td><td><code>Mail.ReadWrite</code></td></tr><tr><td>Impact Level</td><td><mark style="color:green;">Low</mark> - Restores emails</td></tr></tbody></table>

</details>

<details>

<summary>Action: Isolate Device</summary>

Isolates a device using Microsoft Defender for Endpoint, preventing it from communicating with other devices on the network. The device can still communicate with Defender services for management.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>device_id</code> (Defender sensor ID)</td></tr><tr><td>API Endpoints</td><td><code>POST https://api.securitycenter.microsoft.com/api/machines/${sensorID}/isolate</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>release_device</code> action</td></tr><tr><td>Required Permissions</td><td><code>Machine.Isolate</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Device network isolated</td></tr></tbody></table>

</details>

<details>

<summary>Action: Release Device</summary>

Releases a device from isolation in Microsoft Defender for Endpoint, restoring normal network communication.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>device_id</code> (Defender sensor ID)</td></tr><tr><td>API Endpoints</td><td><code>POST https://api.securitycenter.microsoft.com/api/machines/${sensorID}/unisolate</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>isolate_device</code> action</td></tr><tr><td>Required Permissions</td><td><code>Machine.Isolate</code></td></tr><tr><td>Impact Level</td><td><mark style="color:green;">Low</mark> - Restores network access</td></tr></tbody></table>

</details>

<details>

<summary>Action: Block File</summary>

Blocks a file by hash using Microsoft Defender for Endpoint Indicators API. Supports SHA256, SHA1, and MD5 hashes with priority: SHA256 > SHA1 > MD5. Blocked files are prevented from executing across all managed endpoints.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>file_name</code>, and at least one of: <code>hash_sha256</code>, <code>hash_sha1</code>, or <code>hash_md5</code></td></tr><tr><td>API Endpoints</td><td><code>POST https://api.securitycenter.microsoft.com/api/indicators</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>unblock_file</code> action</td></tr><tr><td>Required Permissions</td><td><code>Ti.ReadWrite</code> or <code>Ti.ReadWrite.All</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Blocks file execution globally</td></tr></tbody></table>

</details>

<details>

<summary>Action: Unblock File</summary>

Unblocks a previously blocked file by removing its indicator from Microsoft Defender for Endpoint. This is the reversal action for `block_file`.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>file_name</code>, and at least one of: <code>hash_sha256</code>, <code>hash_sha1</code>, or <code>hash_md5</code></td></tr><tr><td>API Endpoints</td><td><code>GET https://api.securitycenter.microsoft.com/api/indicators</code> (with filter)<br><code>DELETE https://api.securitycenter.microsoft.com/api/indicators/${indicatorID}</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>block_file</code> action</td></tr><tr><td>Required Permissions</td><td><code>Ti.ReadWrite</code> or <code>Ti.ReadWrite.All</code></td></tr><tr><td>Impact Level</td><td><mark style="color:green;">Low</mark> - Removes file block</td></tr></tbody></table>

</details>

<details>

<summary>Action: Block Domain</summary>

Blocks a domain using Microsoft Defender for Endpoint Indicators API, preventing access to all URLs under that domain across all managed endpoints.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>fqdn</code> (fully qualified domain name)</td></tr><tr><td>API Endpoints</td><td><code>POST https://api.securitycenter.microsoft.com/api/indicators</code></td></tr><tr><td>Undo Action</td><td>No - Manual removal required</td></tr><tr><td>Required Permissions</td><td><code>Ti.ReadWrite</code> or <code>Ti.ReadWrite.All</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Blocks domain access globally</td></tr></tbody></table>

</details>

<details>

<summary>Action: Block IP (Azure)</summary>

Blocks an IP address in Microsoft 365 using Azure AD Conditional Access. Creates or updates a named location with blocked IPs and ensures a conditional access policy blocks authentication attempts from that location.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>ip_address</code></td></tr><tr><td>API Endpoints</td><td><code>GET /identity/conditionalAccess/namedLocations</code> (with filter)<br><code>POST /identity/conditionalAccess/namedLocations</code><br><code>PATCH /identity/conditionalAccess/namedLocations/${namedLocationID}</code><br><code>POST /identity/conditionalAccess/policies</code></td></tr><tr><td>Undo Action</td><td>No - Manual policy removal required</td></tr><tr><td>Required Permissions</td><td><code>Policy.Read.All</code>, <code>Policy.ReadWrite.ConditionalAccess</code>, and <code>Application.Read.All</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Blocks authentication from IP</td></tr></tbody></table>

</details>

### Mimecast Actions

Mimecast action connectors use the **Mimecast API V2** to perform email security and threat protection actions. These actions are commonly used for **email sender blocking, URL blocking,** and **threat containment** during incident response. Mimecast provides cloud-based email security, archiving, and continuity services.

> **Primary use cases:** Phishing sender blocking, malicious URL blocking, domain-based threat prevention

{% hint style="info" %}
**Note:** The group `radiantsecurity_blocked_senders` is automatically created if it doesn't exist and is used for sender blocking policies.
{% endhint %}

<details>

<summary>Action: Block Sender</summary>

Blocks a specific email sender address in Mimecast by adding it to the "radiantsecurity\_blocked\_senders" group. The group is created automatically if it doesn't exist, along with the necessary blocked sender policy.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>email_from</code></td></tr><tr><td>API Endpoints</td><td><code>POST /api/directory/find-groups</code><br><code>POST /api/directory/create-group</code><br><code>POST /api/policy/blockedsenders/create-policy</code><br><code>POST /api/directory/add-group-member</code></td></tr><tr><td>Undo Action</td><td>No - Manual removal from group required</td></tr><tr><td>Required Permissions</td><td><p><code>Directories | Groups | All</code>, </p><p><code>Gateway Menu | Policies | All</code> </p><p><code>Directories Menu | Managed Senders | All</code> <em>(in case it exists on the UI)</em>, and</p><p><code>Gateway Menu | Managed Senders | All</code></p></td></tr><tr><td>Impact Level</td><td><mark style="color:$warning;">Medium</mark> - Blocks sender for organization</td></tr></tbody></table>

</details>

<details>

<summary>Action: Block Sender Domain</summary>

Blocks an entire sender domain in Mimecast by adding it to the "radiantsecurity\_blocked\_senders" group. Extracts the domain from the `email_from` field and blocks all emails from that domain.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>email_from</code> (domain is extracted from email address)</td></tr><tr><td>API Endpoints</td><td><code>POST /api/directory/find-groups</code><br><code>POST /api/directory/create-group</code><br><code>POST /api/policy/blockedsenders/create-policy</code><br><code>POST /api/directory/add-group-member</code></td></tr><tr><td>Undo Action</td><td>No - Manual removal from group required</td></tr><tr><td>Required Permissions</td><td><p><code>Directories | Groups | All</code>, </p><p><code>Gateway Menu | Policies | All</code> </p><p><code>Directories Menu | Managed Senders | All</code> <em>(in case it exists on the UI),</em> and</p><p><code>Gateway Menu | Managed Senders | All</code></p></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Blocks entire domain</td></tr></tbody></table>

</details>

<details>

<summary>Action: Block URL</summary>

Blocks a specific URL (exact path match) in Mimecast using Managed URLs. Creates a managed URL entry with action "block" that prevents users from accessing the exact URL.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>full_url</code></td></tr><tr><td>API Endpoints</td><td><code>POST /api/ttp/url/create-managed-url</code></td></tr><tr><td>Undo Action</td><td>No - Manual removal from managed URLs required</td></tr><tr><td>Required Permissions</td><td><code>Monitoring Menu | URL Protection | All</code> </td></tr><tr><td>Impact Level</td><td><mark style="color:$warning;">Medium</mark> - Blocks specific URL</td></tr></tbody></table>

</details>

<details>

<summary>Action: Block URL Domain</summary>

Blocks an entire URL domain (wildcard match) in Mimecast using Managed URLs. Creates a managed URL entry with `matchType: "domain"` that blocks access to all URLs under that domain.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>full_url</code> (domain is extracted from URL)</td></tr><tr><td>API Endpoints</td><td><code>POST /api/ttp/url/create-managed-url</code> (with <code>matchType: "domain"</code>)</td></tr><tr><td>Undo Action</td><td>No - Manual removal from managed URLs required</td></tr><tr><td>Required Permissions</td><td><code>Monitoring Menu | URL Protection | All</code> </td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Blocks entire domain</td></tr></tbody></table>

</details>

### Netskope Actions

Netskope action connectors use the **Netskope REST API v2** to perform cloud access security broker (CASB) and secure web gateway (SWG) actions. These actions are commonly used for **URL blocking** and **web content filtering** during incident response. Netskope provides cloud-native security for SaaS, IaaS, and web traffic.

> **Primary use cases:** Malicious URL blocking, web threat containment

<details>

<summary>Action: Block URL</summary>

Blocks a specific URL in Netskope by adding it to the Radiant Security URL list.&#x20;

{% hint style="warning" %}
**Prerequisites:** Requires the URL list "RADIANT\_SECURITY\_BLOCK\_URL\_POLICY" to be pre-created in Netskope Admin Console and configured in a Real-time Protection policy.
{% endhint %}

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>full_url</code> </td></tr><tr><td>API Endpoints</td><td><code>GET /api/v2/policy/urllist</code><br><code>PATCH /api/v2/policy/urllist/${urllistID}/append</code><br><code>POST /api/v2/policy/urllist/deploy</code></td></tr><tr><td>Undo Action</td><td>No - Manual removal from URL list required</td></tr><tr><td>Required Permissions</td><td><code>/api/v2/policy/urllist</code> endpoints with <code>Read and Write</code> privilege</td></tr><tr><td>Impact Level</td><td><mark style="color:$warning;">Medium</mark> - Blocks URL access</td></tr></tbody></table>

</details>

### Okta Actions

Okta action connectors use the **Okta Management API** to perform identity and access management operations. These actions are commonly used for **account security, session management,** and **network access control** during incident response. Okta serves as a centralized identity provider for managing user authentication and authorization.

> **Primary use cases:** User account lockdown, session termination, IP-based access control

<details>

<summary>Action: Disable Users and Terminate Active Sessions</summary>

Composite action that disables a user account and terminates all active sessions. This is a combination of `disable_user` and `terminate_active_sessions` actions, providing immediate account lockdown.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>user_principal_name</code>, <code>user_id</code>, or <code>service_account_id</code> (user identifier)</td></tr><tr><td>API Endpoints</td><td><code>GET /api/v1/users/${userEmail}</code><br><code>POST /api/v1/users/${id}/lifecycle/suspend</code><br><code>DELETE /api/v1/users/${id}/sessions</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>enable_user</code> action</td></tr><tr><td>Required Permissions</td><td><code>okta.users.read</code>, <code>okta.users.manage</code>, <code>okta.users.userSessions.clear</code>, and <code>okta.users.lifecycle.suspend</code> </td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - User cannot access any systems</td></tr></tbody></table>

</details>

<details>

<summary>Action: Terminate Active Sessions</summary>

Terminates all active sessions for a user in Okta, forcing them to re-authenticate. The user account remains enabled but all existing sessions are invalidated.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>user_principal_name</code>, <code>user_id</code>, or <code>service_account_id</code> (user identifier)</td></tr><tr><td>API Endpoints</td><td><code>GET /api/v1/users/${userEmail}</code><br><code>DELETE /api/v1/users/${id}/sessions</code></td></tr><tr><td>Undo Action</td><td>No - Sessions already terminated</td></tr><tr><td>Required Permissions</td><td><code>okta.users.read</code>, <code>okta.users.manage</code>, and <code>okta.users.userSessions.clear</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$warning;">Medium</mark> - User can re-authenticate</td></tr></tbody></table>

</details>

<details>

<summary>Action: Enable User</summary>

Enables a previously disabled user account in Okta, allowing them to sign in again. Use this to restore access after an incident has been resolved.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>user_principal_name</code>, <code>user_id</code>, or <code>service_account_id</code> (user identifier)</td></tr><tr><td>API Endpoints</td><td><code>GET /api/v1/users/${userEmail}</code><br><code>POST /api/v1/users/${id}/lifecycle/unsuspend</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>disable_users_and_terminate_active_sessions</code> action</td></tr><tr><td>Required Permissions</td><td><code>okta.users.read</code>, <code>okta.users.manage</code>, and <code>okta.users.lifecycle.unsuspend</code></td></tr><tr><td>Impact Level</td><td><mark style="color:green;">Low</mark> - Restores normal access</td></tr></tbody></table>

</details>

<details>

<summary>Action: Reset User Password</summary>

Resets a user's password in Okta and forces them to change it on next sign-in. The account is temporarily suspended and unsuspended to ensure password expiration takes effect.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>user_principal_name</code>, <code>user_id</code>, or <code>service_account_id</code> (user identifier)</td></tr><tr><td>API Endpoints</td><td><code>GET /api/v1/users/${userEmail}</code><br><code>POST /api/v1/users/${id}/lifecycle/expire_password</code><br><code>POST /api/v1/users/${id}/lifecycle/suspend</code><br><code>POST /api/v1/users/${id}/lifecycle/unsuspend</code></td></tr><tr><td>Undo Action</td><td>No - Password already changed</td></tr><tr><td>Required Permissions</td><td><code>okta.users.read</code>, <code>okta.users.manage</code>, <code>okta.users.lifecycle.suspend</code>, and <code>okta.users.lifecycle.unsuspend</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - User must reset password</td></tr></tbody></table>

</details>

<details>

<summary>Action: Block IP</summary>

Blocks an IP address in Okta using Network Zones. Creates a dedicated network zone with the blocked IP and marks it as a blocklist. Each IP gets its own zone for granular control and easier management.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>ip_address</code></td></tr><tr><td>API Endpoints</td><td><code>POST /api/v1/zones</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>unblock_ip</code> action</td></tr><tr><td>Required Permissions</td><td><code>okta.networkZones.manage</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Blocks access from IP globally</td></tr></tbody></table>

</details>

<details>

<summary>Action: Unblock IP</summary>

Unblocks a previously blocked IP address by deleting its network zone in Okta. This is an idempotent operation - if the network zone doesn't exist, it succeeds silently.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>ip_address</code></td></tr><tr><td>API Endpoints</td><td><code>GET /api/v1/zones</code><br><code>DELETE /api/v1/zones/${zoneId}</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>block_ip</code> action</td></tr><tr><td>Required Permissions</td><td><code>okta.networkZones.read</code>, <code>okta.networkZones.manage</code></td></tr><tr><td>Impact Level</td><td><mark style="color:green;">Low</mark> - Restores IP access</td></tr></tbody></table>

</details>

### Proofpoint Actions

Proofpoint action connectors use the **Proofpoint API** to perform email security and threat protection actions. These actions are commonly used for **email sender blocking and spam prevention** during incident response. Proofpoint provides advanced email security, threat intelligence, and compliance solutions.

> **Primary use cases:** Malicious sender blocking, phishing prevention

<details>

<summary>Action: Block Sender</summary>

Blocks an email sender address in Proofpoint, preventing emails from that sender from being delivered to any user in the organization. Blocked senders are added to the organization's blocked sender list.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>email_from</code></td></tr><tr><td>API Endpoints</td><td><code>PATCH /api/v1/orgs/${domain}/sender-lists</code></td></tr><tr><td>Undo Action</td><td>No - Manual removal from sender list required</td></tr><tr><td>Required Permissions</td><td><code>Scope: admin-level access</code>    </td></tr><tr><td>Impact Level</td><td><mark style="color:$warning;">Medium</mark> - Blocks sender for organization</td></tr></tbody></table>

</details>

### SentinelOne Actions

SentinelOne action connectors use the **SentinelOne Management Console API** to perform endpoint protection and response actions. These actions are commonly used for **endpoint containment, threat remediation,** and **malware blocking** during incident response. SentinelOne provides autonomous endpoint protection with AI-driven threat detection.

> **Primary use cases:** Endpoint isolation, malware scanning, file hash blocking

<details>

<summary>Action: Block File</summary>

Blocks a file by SHA1 hash on SentinelOne for all OS types (Windows, Linux, macOS). The file is blocked across all supported operating systems and all managed endpoints within the account.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>hash_sha1</code></td></tr><tr><td>API Endpoints</td><td><code>GET /web/api/v2.1/agents</code> (to get accountId)<br><code>POST /web/api/v2.1/restrictions</code> (called for each OS: windows, linux, macOS)</td></tr><tr><td>Undo Action</td><td>No - Vendor API does not support unblocking</td></tr><tr><td>Required Permissions</td><td>Blocklist: <code>View</code>, <code>Edit</code>, <code>Delete</code>, and <code>Create</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Blocks file across all endpoints</td></tr></tbody></table>

</details>

<details>

<summary>Action: Isolate Device</summary>

Isolates a device on SentinelOne, preventing it from communicating with other devices on the network. The device can still communicate with the SentinelOne management console for administration.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>device_id</code> (SentinelOne device ID)</td></tr><tr><td>API Endpoints</td><td><code>POST /web/api/v2.1/agents/actions/disconnect</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>release_device</code> action</td></tr><tr><td>Required Permissions</td><td>Agents: <code>Network Quarantine Control</code></td></tr><tr><td>Impact Level</td><td><mark style="color:$primary;">High</mark> - Device network isolated</td></tr></tbody></table>

</details>

<details>

<summary>Action: Release Device</summary>

Releases a device from isolation on SentinelOne, restoring normal network communication.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>device_id</code> (SentinelOne device ID)</td></tr><tr><td>API Endpoints</td><td><code>POST /web/api/v2.1/agents/actions/connect</code></td></tr><tr><td>Undo Action</td><td>Yes - via <code>isolate_device</code> action</td></tr><tr><td>Required Permissions</td><td>Agents: <code>Network Quarantine Control</code></td></tr><tr><td>Impact Level</td><td><mark style="color:green;">Low</mark> - Restores network access</td></tr></tbody></table>

</details>

<details>

<summary>Action: Run Full Disk Scan</summary>

Initiates a full disk scan on a device in SentinelOne to detect threats and malware. The scan runs in the background and may impact device performance.

<table><thead><tr><th width="211.15869140625">FIELD</th><th width="457.7745361328125">DETAILS</th></tr></thead><tbody><tr><td>Required Parameters</td><td><code>device_id</code> (SentinelOne device ID)</td></tr><tr><td>API Endpoints</td><td><code>POST /web/api/v2.1/agents/actions/initiate-scan</code></td></tr><tr><td>Undo Action</td><td>No - Scan already initiated</td></tr><tr><td>Required Permissions</td><td>Agents: <code>Initiate Scan</code></td></tr><tr><td>Impact Level</td><td><mark style="color:green;">Low</mark> - Background scan process</td></tr></tbody></table>

</details>

### Revert Capabilities

#### **Understand revert capabilities**

Revert capability determines if an action can be automatically reversed through the platform. Actions with revert support have a paired reversal action. For example, `isolate_device` can be undone with `release_device`, and `disable_user` can be reversed with `enable_user`. This gives you confidence to act decisively, knowing you can quickly restore normal operations.

#### How to reverse an action

If you need to **undo** a remediation step (for example, re-enabling a user after an investigation clears them), you can often do so directly from the same view.

1. Go to the table where you ran the action and find the affected artifact.
2. **Click** to open the right side drawer menu.
3. Look for the **undo** button in the **Action history** section.
4. Confirm to revert the action.

<div align="left"><figure><img src="https://2439665791-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FPsFulb2ZOtSPcRSc2rXE%2Fuploads%2FWMDqTMCbuNCtdoPPFHQS%2FRadiant_Response_Actions_01.png?alt=media&#x26;token=37294ba6-1e04-4d35-a686-2a2018ea4d59" alt="" width="375"><figcaption></figcaption></figure></div>

Some actions are **inherently irreversible** due to their nature or vendor API limitations. The [Actions without revert support](#actions-without-revert-support) table lists why certain actions cannot be automatically reversed. For irreversible actions, we recommend extra caution and choosing less destructive alternatives when possible (e.g., soft delete instead of hard delete an email).

{% stepper %}
{% step %}

### Actions with revert support

<table data-full-width="true"><thead><tr><th width="267.02716064453125">Action</th><th width="259.3941650390625">Reversal Action</th><th width="217.477294921875">Vendors</th></tr></thead><tbody><tr><td><p><code>disable_users_and_</code></p><p><code>terminate_active_sessions</code></p></td><td><code>enable_user</code></td><td>Okta, MS365</td></tr><tr><td><code>enable_user</code></td><td><p><code>disable_users_and_</code></p><p><code>terminate_active_sessions</code></p></td><td>Okta, MS365</td></tr><tr><td><code>isolate_device</code></td><td><code>release_device</code></td><td>MS365 Defender, SentinelOne, CrowdStrike</td></tr><tr><td><code>release_device</code></td><td><code>isolate_device</code></td><td>MS365 Defender, SentinelOne, CrowdStrike</td></tr><tr><td><code>block_ip</code></td><td><code>unblock_ip</code></td><td>Okta</td></tr><tr><td><code>unblock_ip</code></td><td><code>block_ip</code></td><td>Okta</td></tr><tr><td><code>find_and_soft_delete_emails</code></td><td><code>restore_soft_deleted_emails</code></td><td>MS365</td></tr><tr><td><code>restore_soft_deleted_emails</code></td><td><code>find_and_soft_delete_emails</code></td><td>MS365</td></tr><tr><td><code>block_file</code></td><td><code>unblock_file</code></td><td><p>MS365 </p><p>Defender</p></td></tr><tr><td><code>unblock_file</code></td><td><code>block_file</code></td><td><p>MS365 </p><p>Defender</p></td></tr></tbody></table>
{% endstep %}

{% step %}

### Actions without revert support

<table><thead><tr><th width="270.44183349609375">Action</th><th width="260.5777587890625">Reason</th><th>Vendors</th></tr></thead><tbody><tr><td><code>terminate_active_sessions</code></td><td>Sessions already terminated</td><td>Okta, MS365</td></tr><tr><td><code>reset_user_password</code></td><td>Password already changed</td><td>Okta, MS365</td></tr><tr><td><code>disable_all_forward_rules</code></td><td>Manual re-enablement required</td><td>MS365</td></tr><tr><td><code>delete_external_forward_rules</code></td><td>Rules permanently deleted</td><td>MS365</td></tr><tr><td><code>find_and_hard_delete_emails</code></td><td>Permanent deletion</td><td>MS365, Google Workspace</td></tr><tr><td><code>block_domain</code></td><td>Manual removal required</td><td>MS365 Defender</td></tr><tr><td><code>block_file</code></td><td>Vendor API does not support unblocking</td><td>SentinelOne, CrowdStrike</td></tr><tr><td><code>run_full_disk_scan</code></td><td>Scan already initiated</td><td>SentinelOne</td></tr><tr><td><code>block_url</code></td><td>Manual removal from URL list/managed URLs required</td><td>Netskope, Mimecast</td></tr><tr><td><code>block_url_domain</code></td><td>Manual removal from managed URLs required</td><td>Mimecast</td></tr><tr><td><code>block_sender</code></td><td>Manual removal from sender list/filters required</td><td>Proofpoint, Google Workspace, Mimecast</td></tr><tr><td><code>block_sender_domain</code></td><td>Manual removal from group required</td><td>Mimecast</td></tr><tr><td><code>block_ip</code></td><td>Manual policy removal required</td><td>MS365</td></tr><tr><td><code>enroll_in_phishing_training</code></td><td>Training enrollment cannot be undone</td><td>KnowBe4</td></tr></tbody></table>
{% endstep %}
{% endstepper %}

### **Impact Level Definitions**

* <mark style="color:$primary;">**High:**</mark> Significant operational impact; requires immediate attention to restore.
* <mark style="color:$warning;">**Medium:**</mark> Moderate operational impact; users can work around limitation.
* <mark style="color:green;">**Low:**</mark> Minimal operational impact, easily reversible or limited to enrichment only.