Built-in Action Templates
Unified Security Stack ships with 73 pre-built action templates that can serve as components within SOAR workflows. Every template is a reusable command aimed at a particular platform and carries out a defined response action.
Action templates use dynamic variables (e.g., $(adversary.ip)) which are automatically substituted with values from the triggering alert when execution occurs.
Block IP / Firewall Rules
Deny attacker IP addresses or administer firewall rules to contain threats.
| Action | Platform | Command |
|---|---|---|
| Block Adversary IP | Windows | netsh advfirewall firewall add rule name="Block-Brute-Force-$(adversary.ip)" dir=in action=block remoteip="$(adversary.ip)" |
| Block Adversary IP | Linux (Debian/Ubuntu) | iptables -A INPUT -s $(adversary.ip) -j DROP |
| Block Adversary IP | Linux (RHEL/CentOS) | firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="$(adversary.ip)" drop' --permanent && firewall-cmd --reload |
| Block Adversary IP | Linux (OpenSUSE) | firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="$(adversary.ip)" drop' --permanent && firewall-cmd --reload |
| Block Attacker IP via UFW | Linux (Debian/Ubuntu) | ufw deny from $(adversary.ip) to any |
| Block Inbound Network Access | Windows | netsh advfirewall firewall add rule name="Block-Inbound-$(adversary.ip)" dir=in action=block remoteip="$(adversary.ip)" |
| Block Inbound Network Access | Linux (Debian) | iptables -A INPUT -s $(adversary.ip) -j DROP |
| Block Inbound Network Access | Linux (RHEL) | firewall-cmd --zone=public --add-rich-rule='...' --permanent && firewall-cmd --reload |
| Block Inbound Network Access | Linux (OpenSUSE) | firewall-cmd --zone=public --add-rich-rule='...' --permanent && firewall-cmd --reload |
| Block Inbound Network Access | macOS | echo "block in from $(adversary.ip) to any" | pfctl -f - |
| Block Outbound Network Access | Windows | netsh advfirewall firewall add rule name="Block-Outbound-$(adversary.ip)" dir=out action=block remoteip="$(adversary.ip)" |
| Block Outbound Network Access | Linux | iptables -A OUTPUT -d $(adversary.ip) -j DROP |
| Block Outbound Network Access | macOS | echo "block out from any to $(adversary.ip)" | pfctl -f - |
| Enable Firewall Rules | Windows | netsh advfirewall firewall set rule name=all new enable=yes |
| Enable Firewall | Windows | netsh advfirewall set allprofiles state on |
Kill Process
End malicious or suspicious processes on endpoints.
| Action | Platform | Command |
|---|---|---|
| Kill Process | Windows | taskkill /F /IM (Split-Path -Path "$(adversary.process)" -Leaf) |
| Kill Process | Linux | pkill -9 $(basename "$(adversary.process)") |
| Kill Process | macOS | pkill -9 $(basename "$(adversary.process)") |
| Kill Process by PID | Windows | taskkill /F /PID $(log.winlogEventDataProcessId) |
| Kill Process by Name | Windows | taskkill /F /IM $(log.winlogEventDataProcessName) |
Disable User Account
Deactivate compromised or unauthorized user accounts to stop additional access.
| Action | Platform | Command |
|---|---|---|
| Disable adversary.user | Windows | net user $(adversary.user) /active:no |
| Disable adversary.user | Linux | usermod -s /sbin/nologin $(adversary.user) |
| Disable adversary.user | macOS | chsh -s /usr/bin/false $(adversary.user) |
| Disable target.user | Windows | net user $(target.user) /active:no |
| Disable target.user | Linux | usermod -s /sbin/nologin $(target.user) |
| Disable target.user | macOS | chsh -s /usr/bin/false $(target.user) |
| Disable Compromised User (expire) | Linux | usermod --expiredate 1 $(target.user) |
Kill Session / Logout User
Force a compromised user session to log out.
| Action | Platform | Command |
|---|---|---|
| Kill Session and Logout User | Windows | logoff $(target.user) |
| Kill Session and Logout User | Linux | pkill -KILL -u $(target.user) |
| Kill Session and Logout User | macOS | pkill -KILL -u $(target.user) |
Remove Permissions
Revoke elevated permissions from compromised accounts.
| Action | Platform | Command |
|---|---|---|
| Remove All Permissions | Windows | Get-LocalGroup | Where-Object { $_.Name -ne "Users" } | ForEach-Object { Remove-LocalGroupMember ... } |
| Remove All Permissions | Linux | for grp in $(id -nG $(adversary.user) ...); do gpasswd -d $(adversary.user) "$grp"; done |
| Remove All Permissions | macOS | for grp in ...; do dseditgroup -o edit -d $(adversary.user) ...; done |
Isolate Host
Sever a compromised host's connection to the network to limit lateral movement.
| Action | Platform | Command |
|---|---|---|
| Isolate Host | Windows | Get-NetAdapter | Disable-NetAdapter -Confirm:$false |
| Isolate Host | Linux | for interface in $(ip link show | ...); do ip link set "$interface" down; done |
| Isolate Host | macOS | for interface in $(networksetup -listallnetworkservices ...); do networksetup -setnetworkserviceenabled "$interface" off; done |
Host isolation disables every network adapter. The agent will lose its connection to Unified Security Stack. Use this action only as a final measure for verified critical threats. Restoring connectivity will require physical or out-of-band access.
Delete File
Delete malicious files from endpoints.
| Action | Platform | Command |
|---|---|---|
| Delete File | Windows | Remove-Item -LiteralPath "$(adversary.path)" -Force -Recurse |
| Delete File | Linux | rm -f $(adversary.path) |
| Delete File | macOS | rm -f $(adversary.path) |
Stop Service
Halt malicious or compromised services.
| Action | Platform | Command |
|---|---|---|
| Stop Service | Windows | Stop-Service -Name "$(adversary.windowsServiceDisplayName)" -Force |
| Stop Service | Linux | systemctl stop "$(adversary.service)" |
| Stop Service | macOS | launchctl stop "$(adversary.service)" |
Uninstall Application
Uninstall unauthorized or compromised applications.
| Action | Platform | Command |
|---|---|---|
| Uninstall Application | Windows | ForEach-Object { Start-Process ... -ArgumentList "/S" ... } |
| Uninstall Application | Linux (Debian) | apt-get remove -y "$(target.applicationname)" |
| Uninstall Application | Linux (RHEL) | yum remove -y "$(target.applicationname)" |
| Uninstall Application | Linux (OpenSUSE) | zypper remove -y "$(target.applicationname)" |
| Uninstall Application | macOS | brew uninstall --force "$(target.applicationname)" |
Shutdown Host
Force a critically compromised system to shut down.
| Action | Platform | Command |
|---|---|---|
| Shutdown OS (Forced) | Windows | shutdown /s /f /t 0 |
| Shutdown OS (Forced) | Linux | shutdown -h now |
| Shutdown OS (Forced) | macOS | shutdown -h now |
A forced shutdown immediately cuts power to the system. Any unsaved data will be lost. Use it only for confirmed critical threats where the risk of continued operation outweighs the cost of downtime.
Disable RDP
Turn off Remote Desktop Protocol access on Windows systems.
| Action | Platform | Command |
|---|---|---|
| Disable RDP and Remove FW Rule | Windows | Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 1; Disable-NetFirewallRule -DisplayGroup "Remote Desktop" |
Windows Defender Management
Turn Windows Defender settings back on or restore those that have been altered.
| Action | Platform | Description |
|---|---|---|
| Enable Windows Defender | Windows | Enables real-time protection via MpCmdRun.exe -Enable |
| Enable Real-time Monitoring | Windows | Set-MpPreference -DisableRealtimeMonitoring $false |
| Restore Behavior Monitoring | Windows | Re-enables behavior monitoring |
| Restore PUA Protection | Windows | Re-enables Potentially Unwanted Application protection |
| Restore MAPS Reporting | Windows | Re-enables Microsoft Active Protection Service reporting |
| Restore Cloud Protection | Windows | Re-enables cloud-based protection |
| Auto Re-enable All Protections | Windows | Detects which protections were disabled and re-enables them |
| Remove Process Exclusion | Windows | Removes process exclusions added to Defender |
| Remove Folder Exclusion | Windows | Removes folder exclusions added to Defender |
| Remove All Exclusions | Windows | Removes both process and folder exclusions added via PowerShell |