Actions15
- Active Response Actions
- Agent Actions
- Decoder Actions
- Indexer Actions
- Rule Actions
- Security Event Actions
- Vulnerability Actions
Decoder → Run Command
AI-generatedSummary
Sends a Wazuh Active Response command to the selected agents, or to all agents when the Agents field is empty. The request can include command arguments and alert data, and can set whether to wait for completion.
Inputs
- Command (required) — Active Response command name, such as
!firewall-drop. - Agents — Comma-separated agent IDs. Leave blank to target all agents.
- Arguments — Comma-separated arguments passed to the command.
- Alert Data — JSON object sent as
alert.data; defaults to{}. - Wait for Complete — Controls the Wazuh API
wait_for_completeparameter; defaults to false.
Output shape
A single response body object per input item.
The node makes a PUT request to the Wazuh Manager API
/active-responseendpoint. Empty arguments and alert data are omitted from the request payload. Invalid Alert Data JSON or a non-object value causes an error. With Continue On Fail enabled, errors are returned as{ "error": "..." }for the affected item.