The Response Action Log provides a centralized, time-ordered record of all manually requested response actions. Access the log by selecting Logs > Response action log in the sidebar menu.

This log serves as the authoritative audit trail for manual response action workflows, enabling security teams to verify action effectiveness, satisfy compliance requirements, and reconstruct the response timeline during post-incident review.

Log Table

Each log entry in the table shows the status of the action, the action, the key data (the file path, the process name, or the friendly name of the SSH key), the target host, the time of the request, the Sandfly user that requested the action, the source artifact (for result-based actions), and a message with the details. The Message column is the last column before the actions column, so you may need to scroll the table to the right to see it. To show more columns, such as the action type, the run ID, the completion time, the target address, the last seen IP address, and the file hashes, use Manage columns in the column header menu.

Use the quick filters in the table toolbar to limit the log to specific entries:

• Status - The status of the action, such as Success or Failed. The statuses are described below.
• Type - What the action acts on: SSH Key, Process, or File.
• Action - The action, such as process_kill or file_retrieve. The list shows only the actions in the loaded log entries.

Action Status

Each log entry reflects the current state of the action. Possible status states include:

• Success - The action is completed as requested.
• Failed - The action could not be completed. Refer to the Message column for details.
• Verification failed - The process is no longer running, or its hash cannot be calculated or does not match the hash in the original result. The action is not executed.
• Host denied - The Node that serves the host has response actions disabled. The action is not executed.
• Skipped - The action did not run.
• Pending - The action has been submitted, but a response has not yet been received.

Details Page

To open the Details page of a log entry, click the linked Action value or double-click the table row. The page shows the full details of the log entry, including the values that are hidden by default in the table, on these cards:

• Receipt - The result of the action and the message that came back with it.
• Source artifact or SSH key info - A snapshot of the artifact or SSH key, saved when the action was requested.
• Sandfly results - The sandfly results of the artifact at the time of the snapshot.
• Related actions - Other response actions on the same target.
• Raw response JSON - The raw JSON of the log entry. Click View full JSON to show all of it. When the JSON is too large to show on the page, it opens in a new browser tab.

The snapshot data stays available after the original artifact is deleted.

Retrieve Actions

Users with the Responder role can perform the following retrieval actions when the response action request completed successfully. These buttons are in the actions column of the table and in the page header of the Details page of a retrieval action.

• Download - Downloads the retrieved file through the browser. The file name contains the artifact ID, the file or process name, and the SHA-256 hash of the file. The files remain available for download until they are manually deleted or automatically purged as per the file retention setting.
• Delete - Removes the retrieved file from this log entry. The log entry stays, but you can no longer download the file from it. Sandfly deletes the stored file from its database when no log entry refers to the file.