[Security] Response Actions History privilege required for response console output - #7860
Open
natasha-moore-elastic wants to merge 2 commits into
Open
[Security] Response Actions History privilege required for response console output#7860natasha-moore-elastic wants to merge 2 commits into
natasha-moore-elastic wants to merge 2 commits into
Conversation
…onsole output Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Elastic Docs AI PR menuCheck the box to run an AI review for this pull request.
Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team. |
Contributor
Contributor
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
paul-tavares
approved these changes
Aug 7, 2026
paul-tavares
left a comment
paul-tavares
left a comment
Contributor
There was a problem hiding this comment.
Left a suggestion (optional).
Thanks for getting this out
|
|
||
| These are required to perform actions both in the response console and in other areas of the {{security-app}} (such as isolating a host from a detection alert). | ||
| * Users must have the appropriate user role or privileges for at least one response action to access the response console. | ||
| * In addition to the privilege for each response action, users need at least **Read** access to the **Response Actions History** [privilege](/solutions/security/configure-elastic-defend/elastic-defend-feature-privileges.md) to view command output and status in the response console. Without it, running a response action in the console can return an error even when the user has privileges for that action. |
Contributor
There was a problem hiding this comment.
For the last sentence here, which is also used in the elastic-defend-feature-privileges.md, I would suggest this:
Suggested change
| * In addition to the privilege for each response action, users need at least **Read** access to the **Response Actions History** [privilege](/solutions/security/configure-elastic-defend/elastic-defend-feature-privileges.md) to view command output and status in the response console. Without it, running a response action in the console can return an error even when the user has privileges for that action. | |
| * In addition to the privilege for each response action, users need at least **Read** access to the **Response Actions History** [privilege](/solutions/security/configure-elastic-defend/elastic-defend-feature-privileges.md) to view command output and status in the response console. Without it, running a response action in the console will create the action request, but the user will be unable to monitor its completion and will not be able to view its results. |
bmorelli25
reviewed
Aug 7, 2026
| | **{{elastic-defend}} Policy Management** | Access the [Policies](/solutions/security/manage-elastic-defend/policies.md) page and {{elastic-defend}} integration policies to configure protections, event collection, and advanced policy features. | | ||
| | **{{elastic-defend}} Scripts Management** {applies_to}`stack: ga 9.4+` {applies_to}`serverless: ga` | Access the [script library](/solutions/security/endpoint-response-actions/script-library.md) to upload and manage scripts for {{elastic-defend}} `runscript` response actions. | | ||
| | **Response Actions History** | Access the [response actions history](/solutions/security/endpoint-response-actions/response-actions-history.md) for endpoints. | | ||
| | **Response Actions History** | Access the [response actions history](/solutions/security/endpoint-response-actions/response-actions-history.md) for endpoints.<br><br>Also required (at least **Read**) to view command output and status in the [response console](/solutions/security/endpoint-response-actions.md). Grant this privilege whenever you grant any response-action privilege (such as **Host Isolation**, **Process Operations**, and so on). If this privilege is **None**, running a response action in the console can return an error even when the user has privileges for that action. | |
Member
There was a problem hiding this comment.
Suggested change
| | **Response Actions History** | Access the [response actions history](/solutions/security/endpoint-response-actions/response-actions-history.md) for endpoints.<br><br>Also required (at least **Read**) to view command output and status in the [response console](/solutions/security/endpoint-response-actions.md). Grant this privilege whenever you grant any response-action privilege (such as **Host Isolation**, **Process Operations**, and so on). If this privilege is **None**, running a response action in the console can return an error even when the user has privileges for that action. | | |
| | **Response Actions History** | Access the [response actions history](/solutions/security/endpoint-response-actions/response-actions-history.md) for endpoints.<br><br>Also requires (at least **Read**) to view command output and status in the [response console](/solutions/security/endpoint-response-actions.md). Grant this privilege whenever you grant any response-action privilege (such as **Host Isolation**, **Process Operations**, and so on). If this privilege is **None**, running a response action in the console can return an error even when the user has privileges for that action. | |
bmorelli25
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents that Response Actions History (at least Read) is required to view command output and status in the response console, in addition to the relevant response-action privilege.
Resolves #7275
Made with Cursor