Actions15
- Active Response Actions
- Agent Actions
- Decoder Actions
- Indexer Actions
- Rule Actions
- Security Event Actions
- Vulnerability Actions
Active Response → Run Command
AI-generatedSummary
Runs a Wazuh Active Response command through the Manager API for selected agents or all agents. Optionally passes comma-separated command arguments and alert data, and can set whether to wait for completion.
Inputs
- Command (required) — Active Response command name, for example
!firewall-drop. - Agents — Comma-separated agent IDs. Leave empty to target all agents.
- Arguments — Comma-separated arguments passed to the command.
- Alert Data — JSON object sent as
alert.data; empty data is omitted from the request. - Wait for Complete — Controls the
wait_for_completerequest parameter; defaults to false.
Output shape
A single item containing the Wazuh API response body.
The node sends a PUT request to
/active-response. With Continue On Fail enabled, an item that fails instead contains anerrormessage.