Actions

Overview

The Actions page, titled Response action history, is the log of every automated defensive action the system has executed in response to detected attacks. Each row represents a single action – for example, blocking an attacker’s IP address on the web server or firewall – together with its execution status (whether the request is still pending, succeeded, or failed). Use this page to verify that the system responded to an attack, check whether a mitigation request actually went through, investigate what was blocked and when, or search for actions targeting a specific host.

Actions are created automatically by the Action Manager service when it detects new attacker IPs in incoming attack notifications. You cannot create or delete action records from this page; it is a read-only log.

All times on this page are shown and filtered in UTC, as indicated by the UTC timeline badge in the page header.

How to Open This Page

Click Actions in the main navigation bar. The page opens with the actions recorded in the last 24 hours, newest first.

Main Areas

The page is organized from top to bottom as follows:

Click to enlarge

• 1 Page header - the Response action history title, a short description, and the UTC timeline badge reminding you that all times are UTC.
• 2 Filter deck - Search & apply, Time range, From / To (custom range only), and Sort order. Changes in the deck are staged and take effect when you click Apply.
• 3 Evidence columns - shows how many columns are visible and lets you manage them (Manage, Default, Hide all).
• 4 Search summary - Searched followed by the interval that was actually searched (UTC), the number of results, and the active search query, if any.
• 5 Results table - one action per row, with the View buttons, the Execution status badge, and the selected evidence columns.
• 6 Total Results and pagination - the total number of matching records and the page selector.

Filter Deck

The filter deck sits directly below the page header. It uses a single apply model: you can change the search text, time range and sort order in any order, and nothing is re-queried until you click Apply (or press Enter in the search field).

Click to enlarge

• 1 Search & apply - the search field and the Apply button.
• 2 Time range - the preset selector (here set to Custom range).
• 3 From / To - the start and end of the custom range, in UTC.
• 4 Sort order - the staged sort choice.
• 5 Status bar - for a custom range it reads Custom range staged and reminds you that changes apply only after Apply.

Search & Apply

Type a search term into the field (placeholder Search response history) and click Apply or press Enter. The search runs across all fields of the action records, not only the visible columns. When the field contains text, an X (Clear search) button appears inside it; clearing the text does not re-run the search until you click Apply again.

Search queries use OpenSearch query string syntax. You can type plain text to match across all fields, or use field-specific syntax:

Search restrictions:

• A search term cannot start with * or ? (a leading wildcard, for example Log:*Failed* or Host:*foo). Such a search is refused with the message Search terms cannot start with * or ? (leading wildcards are not supported). Use a trailing wildcard on text fields (for example Type:HTTP*) or CIDR notation on IP fields (for example Host:“10.10.40.0/24”).. A * inside a quoted phrase, a lone * (all records) and Field:* (the field has any value) are allowed.
• A search can be at most 4096 characters long. A longer one is refused with The search query is too long (maximum 4096 characters).

A refused search is shown in an Error on performing operation! dialog, and the table shows no results until you correct the search and apply it again. IP address fields such as Host and AttackerHost do not match wildcard patterns (for example Host:10.10.40.* finds nothing); use a network in CIDR notation instead, for example Host:"10.10.40.0/24".

You can also use the cell menus in the table (described below) to build filters without typing any syntax.

Time Range

The Time range selector (hint: UTC window) offers these options:

When you pick a preset, the From and To fields are hidden and the status bar shows the Resolved window – the preset name and the exact UTC start and end it resolves to – with the reminder Press Apply to update results.

Click to enlarge

• 1 Time range set to a preset (Last 7 days).
• 2 Resolved window - the concrete UTC boundaries the query will use once you click Apply.

From and To

With Custom range selected, the From and To fields set the start and end of the window. Both use the format YYYY-MM-DD HH:MM and are interpreted as UTC (each field carries a UTC tag). Click a field to open the date and time picker.

Sort Order

The Sort order selector (hint: Staged until Apply) lets you sort by the fields of action records: Recorded time, Host, Port, Protocol, Action Type, or Application, each in DESC or ASC order. Sorting by Action Type groups the actions alphabetically by type. The default is Recorded time DESC (newest first). A new choice is highlighted as staged and only takes effect when you click Apply.

You can also sort directly from the table by clicking a sortable column header (see Results Table); header sorting applies immediately.

Evidence Columns

The Evidence columns bar controls which data fields appear as columns in the table. The summary shows how many columns are visible (for example 5 columns shown) followed by a short preview of their names.

Click to enlarge

• 1 Summary / Manage - click anywhere on the summary (or Manage) to open the column menu; the button reads Close while it is open.
• 2 Default - restores the default column set. It is disabled while the defaults are already active.
• 3 Hide all - hides every evidence column. A notice All evidence columns hidden. appears with a Restore default button.
• 4 Column menu - a Search columns field and the list of available columns. Selected columns show a check mark and Shown in the table; others show a plus sign and Hidden from the table. Click an entry to toggle it.

Press Escape or click outside the menu to close it.

Default Columns

On your first visit the table shows these five evidence columns:

Additional Columns

You can add these fields through the column menu:

Long-text and internal fields (Description, Log, GUID) and fields that belong to other pages are not offered as columns. They are always available in the detail panel.

Your column choice is remembered for the current browser tab session.

Results Table

Each row is one action record. The first two columns are always present:

• View - two icon buttons (see below).
• Execution status - the status badge of the action (see below).

The remaining columns are the evidence columns you selected.

View Column

• Eye icon (Open action details) - opens the detail panel for that action. The selected row is highlighted. Clicking the eye icon of the same row again closes the panel.
• Code icon (Download action JSON) - downloads the complete raw action record as a JSON file named after the record ID. The raw record comes straight from the data store and can contain fields that are not shown in the table.

Execution Status

The Execution status column shows a colored badge derived from the outcome: value written by the Action Manager into the action’s execution log (for example Request sent to FortiGate firewall; outcome: Completed).

Click to enlarge

• 1 Search summary showing the searched interval, result count and active query.
• 2 Pending badge (amber, clock icon).
• 3 Succeeded badge (green, check icon).
• 4 Failed badge (red, cross icon).

Hover a badge to see the tooltip Execution status: <status>. To list only failed actions, search for Log:Failed*.

Sorting From the Header

Column headers for sortable fields (Recorded time (UTC), Host, Port, Protocol, Action Type - the same fields as the Sort order selector) show a sort hint icon. Click a header to sort by that column; click it again to flip the direction. A new column always starts in descending order. The active column shows an arrow indicating the direction, and the Sort order selector in the filter deck is updated to match.

Cell Menus (Fast Filtering)

Every value in an evidence column is a small button with a chevron. Click it to open a menu with these options:

Click to enlarge

• 1 The clicked cell value.
• 2 The cell menu with the filter, chart and existence options.

Menu options apply immediately (no Apply needed) and reset the table to page 1. The menu opens above the table, so it is never cut off by the table edge; close it with Escape or by clicking elsewhere. You can also navigate it with the arrow keys.

You can also middle-click (press the mouse wheel) on any cell value to immediately add an Exclude filter for it.

Conditions accumulate: each Add or Exclude is appended to the existing search text. To start over, click the X in the search field and then Apply.

Detail Panel

Click the eye icon on a row to open the Action details panel on the right side of the page.

Click to enlarge

• 1 Eye icon highlighted on the selected row.
• 2 Panel header - title Action details and, on the line below it, the execution status badge followed by the record line: action type, protected host and recorded time (for example Block · 10.10.40.20 · 2026-10-13 04:26 UTC).
• 3 Panel controls - Show full screen, Minimize, and Close.
• 4 Evidence summary - Recorded time · UTC (for example 2026-10-13 04:26 UTC; hover it for the raw stored timestamp), Protected host, Attacker host, Traffic (protocol and port), Attack type, and Application. Fields without a value are omitted.
• 5 Description - the human-readable summary of the action.
• 6 Technical record - a collapsed section with the field count; click it to expand.

Technical Record and Raw Execution Log

Expand Technical record to see the full execution detail:

Click to enlarge

• 1 Raw execution log - the exact log text written by the Action Manager, including the outcome: value the status badge is based on (for example outcome: Failed: firewall API timeout). If no log was recorded, the panel says No execution log was recorded.
• 2 Remaining technical fields - such as GUID, First Seen, Last Seen, the linked notification and attack statistics GUIDs, and the index metadata. Each field shows its readable name with its technical key in parentheses, and each value has the same cell menu (Add, Exclude, Show Chart, Exists, NOT Exists) as the table. First Seen and Last Seen are shown as YYYY-MM-DD HH:MM UTC; hover a date to see the raw stored timestamp, which is also what Add and Exclude write into the search.

Panel Controls

Minimized Panels Tray

You can keep several action records at hand while you continue working with the table:

• Click Minimize in the panel header to dock the current record into the tray at the bottom-right of the page.
• When a panel is open and you open a different record, the previous one is minimized into the tray automatically.

Click to enlarge

• 1 A minimized record pill with two lines: the action type and protected host on top (for example Block · 10.10.40.26; shortened with an ellipsis if it is too long, hover it to see the full text) and the recorded time underneath (for example 2026-10-13 09:25 UTC), which is always shown in full. Click the pill to restore the record as the open panel.
• 2 The X on a pill closes that record.

Each record appears only once (either open or in the tray). The tray is kept until you close the pills or leave the page.

Chart View

Select Show Chart in any cell menu to open the chart view for that field. It replaces the detail panel and shows how values of the field are distributed across all records that match the current search and time range.

Click to enlarge

• 1 Chart header - the field name (here Host). The chart header shows no record details such as an execution status badge.
• 2 Chart toolbar - Export, Quick Search…, size selector, and Exit.
• 3 Bar chart of the value distribution.
• 4 Table of values (Field) and their Count, with its own paging.

Chart Controls

Interacting With the Chart

• Click a bar label or a value in the table to add it as a filter (applied immediately).
• Middle-click a bar label or value to exclude it.
• Use Show full screen in the panel header (or double-click the header) to enlarge the chart.

Pagination

Below the table, Total Results shows the number of matching records. When there is more than one page (10 records per page), page buttons appear on the right, together with next and, once you are past page 1, first and previous buttons. Pagination stops at page 1,250; narrow your filters if you need records beyond that.

Understanding Action Data

Each action record represents one automated defensive step the system took in response to a detected attack. Actions are created by the Action Manager service when it processes attack notifications and determines that a new attacker IP needs to be handled.

How Actions Relate to Other Records

An attack notification arrives from a detection system and appears on the Notifications page. The Action Manager deduplicates and aggregates these notifications into attack statistics, which appear on the Attacks page. For each new attacker IP discovered in an attack, the Action Manager creates an action record – one action per attacker IP per attack event. The action record documents which system executed the action and whether it succeeded.

Each action is linked to a specific attack notification and attack statistics record (their GUIDs are listed in the Technical record), forming a chain: Detection (notification) → Aggregation (attack) → Response (action).

Action Types

The values you see in Action Type depend on the response integrations configured in the Action Manager. The most common are:

Key Fields to Examine When Investigating

• Execution status – tells you at a glance whether the action is still pending, succeeded, or failed.
• Action Type – confirms what defensive step was taken.
• Attacker Host – the IP address the action was taken against. Cross-reference with the Blocklist to verify the IP is currently blocked.
• Raw execution log – the Action Manager’s own record of the execution, including the outcome and, for failures, the reason (for example an API timeout). Use it to troubleshoot failed actions.
• Description – a brief summary of the action, usually naming the attacker, the target and the attack type.
• Attack type – the type of attack that triggered the action (inherited from the source notification).
• Application – the system that executed or requested the action.

Notes

• The Actions page is read-only. You cannot create, edit, or delete action records from this page.
• All times are UTC, both in the table and in the From / To fields.
• Changes to the search text, time range and sort order in the filter deck take effect only after Apply (or Enter in the search field). Cell menu options and column-header sorting apply immediately.
• The Execution status is derived from the outcome: in the execution log. An action whose log has no recognizable outcome shows Status unavailable.
• Actions are stored in OpenSearch. Records older than the configured Retention Policies period are removed and no longer appear.
• Your evidence column choice, search text, dates and sort order are remembered for the current browser tab session.
• The JSON download (code icon) fetches the full record directly from the data store, which may contain fields not shown on the page.

Related Pages

• Notifications – View the attack notifications that trigger actions.
• Attacks – See aggregated attack statistics including which actions were executed.
• Blocklist – View and manage the IP addresses currently blocked by the platform.
• Action Manager – Configure settings for the automated action execution service.
• Retention Policies – Configure how long action logs are kept.