Actions15
- Active Response Actions
- Agent Actions
- Decoder Actions
- Indexer Actions
- Rule Actions
- Security Event Actions
- Vulnerability Actions
Rule → Run Command
AI-generatedSummary
Runs a Wazuh Active Response command through the Manager API for selected agents or all agents. Sends optional comma-separated command arguments and alert data, with an option to wait for completion.
Inputs
- Command (required) — Active Response command name, such as
!firewall-drop. - Agents — Comma-separated agent IDs. Leave blank to target all agents.
- Arguments — Comma-separated arguments passed to the command.
- Alert Data — JSON object sent as
alert.data; omitted from the request when empty. Must be a JSON object. - Wait for Complete — Boolean sent as the
wait_for_completequery parameter; defaults to false.
Output shape
A single object containing the Wazuh API response body for each input item.
The operation sends a PUT request to
/active-response. API or input errors fail the item unless Continue On Fail is enabled, in which case the output contains anerrorfield.