Result-based response actions require the Responder role. On the Artifact detail page, each available action shows as an icon button in the page header and as an option of the Respond menu at the bottom of the Artifact triage summary card. To run an action on several detections at once, select them on the Artifacts page or on the Triage or Detections tab of a host, and then use the Respond menu in the bulk actions bar.

The bulk Respond menu offers Retrieve binaries and files, Suspend processes, Resume processes, and Kill processes. Each action applies only to the selected detections that it fits, for example process actions to process detections.

Response Actions

The available response actions depend on the type of detection, as described below. Not every detection has an action available.

Every requested action, the result of the action, and anything retrieved will be recorded in the Response Action Log. A successfully retrieved file, be it a process binary or an on-disk file, can be downloaded from there.

Process Related

Process response actions allow responders to kill, suspend, resume, or retrieve the binary of a process on a host. These actions apply to detections from process sandflies. The Suspend process, Resume process, and Kill process actions show only when the detection has a process ID (PID). Sandfly rejects a process action when the detection does not contain a SHA-512 hash of the process binary.

Before Sandfly runs a process action on the host, it verifies the target process: the process must still run, and the SHA-512 hash of its binary must match the hash recorded in the detection. If the process no longer runs, its hash cannot be calculated, or the hash does not match, Sandfly does not run the action and logs its status as Verification failed. The Resume process action works only on a suspended process; for any other process state, the action fails.

File Related

File response actions allow responders to retrieve a copy of a file from the host. In the UI, this action is available only for detections from sandflies that use the file, cron, or at_jobs engine and that contain a path to the target file.

Unlike process actions, file retrieval does not perform hash verification, as files may change between detection and retrieval.

If Sandfly already has a stored copy of the same binary or file (with the same SHA-512 hash), the retrieval completes immediately from that copy without connecting to the host, even when the host is inactive. The Response action log then shows the status Success with the message "Fulfilled from previously retrieved data".