Use this SOAR action to run a custom script on a selected endpoint, or on an endpoint that is associated with selected alerts.

  • This action can be run from an alert and from a device. It can be run on only one alert or device at a time.
  • The custom script must reside on the selected endpoint and include a valid path and command.
  • Output is written to the path and file name that is specified in the Output field