Actions15
- Active Response Actions
- Agent Actions
- Decoder Actions
- Indexer Actions
- Rule Actions
- Security Event Actions
- Vulnerability Actions
Security Event → Run Command
AI-generatedSummary
Runs a Wazuh Active Response command on selected agents or, if Agents is empty, on all agents. Sends the command and any supplied arguments and alert data to the Wazuh Manager API.
Inputs
- Command (required) — Active Response command name, such as
!firewall-drop. - Agents — Comma-separated agent IDs; leave empty to target all agents.
- Arguments — Comma-separated arguments passed to the command. Empty input sends no arguments.
- Alert Data — JSON object sent as
alert.data; defaults to{}and is omitted from the request when empty. - Wait for Complete — Defaults to
false; passed to the Wazuh API aswait_for_complete.
Output shape
A single response body object for each input item.
The node sends a PUT request to the Wazuh Manager API
/active-responseendpoint. Invalid Alert Data JSON or a non-object value causes an error; API errors also fail the operation unless Continue On Fail is enabled, in which case the item contains anerrorfield.