Use the Nebula console to quickly and easily perform actions across thousands of endpoints with just a few clicks. This article explains the actions available to you.
Actions are performed from the Endpoints screen.
- On the left navigation pane, go to Manage > Endpoints.
- Select endpoints.
- In the top left, click Actions.
- Select one of the actions from the drop-down menu:
- Scan + Report: Tells the endpoint to check for protection updates, then run a Threat Scan and report the results. Any detected threats are not removed.
- Scan + Quarantine: Tells the endpoint to check for protection updates, then run a Threat Scan. Any detected threats are quarantined and scan results are reported.
- Scan Inventory & Vulnerability: Updates hardware asset information and checks for software vulnerabilities on the endpoint. For more information on asset information updated, see Software management policy settings in Nebula.
-
Custom Scan: Tells the endpoint to check for protection updates, then run a Threat Scan using the options selected in the window. For more information on each setting, see Types of scans in Nebula.
- The customizable options are for Windows only. If endpoints of other operating systems are selected, a Threat Scan will run and quarantine detected threats.
- Update Agent: Tells the endpoint to install the latest endpoint software. A restart may be needed to complete the installation. IMPORTANT: Reboots are handled as configured via your policy Reboot Options.
- Check for Agent Updates: Tells the endpoint to perform an immediate check for Agent Updates. If an update is available, a status indicator displays and an Update Agent action must be issued to initiate the update.
- Check for Protection Updates: Tells the endpoint to perform an immediate check for Protection Updates. While scans also do this, selecting this action makes sure that Real-time Protection uses the most recent updates. For more information, see Protection Updates settings in Nebula.
-
Restart Endpoint(s): Reboot the selected endpoint(s).
- Allow user to postpone: Enables a popup on endpoints that allows users to postpone a reboot by preset times of 10, 30, or 60 minutes. Users can also click the X in the top-right corner to dismiss the pop-up and honor the reboot timer displayed in the window. Reminders to postpone the reboot appear 10 minutes before and once the time elapses. If the reboot is not postponed, the endpoint automatically reboots 1 minute after the time elapses. Reboot postponements are displayed on the Events screen as an Audit event.
- Quarantine Threat(s): Quarantines found threats on an endpoint. A restart may be needed to complete remediation.
-
Generate Diagnostic Logs: Tells the online endpoint to send diagnostic logs to Nebula. When the task completes, the Diagnostic Logs Available icon
displays on the Endpoint Details page in the top-right corner. Hover your cursor over this icon for the option to download the logs.
- Launch Active Response Shell: Launches the Active Response Shell remote session on Windows and Linux endpoints. Windows ARM devices are not supported. For more information, see Active Response Shell in Nebula.
- Isolate Endpoint(s): Isolates the endpoint from the network to prevent an active threat from spreading. The console continues to communicate with the endpoint. This feature requires Endpoint Detection and Response.
- Remove Isolation: Restores access to the endpoint if it is isolated. This feature requires Endpoint Detection and Response.
- Cancel Pending Tasks: Cancel a task if it is in the Pending status. This does not work on tasks that are Processing or Complete. Use this if you issued a task by mistake or changed your mind.
- Move: Moves the endpoint to a different selected group within Nebula. For more information, see Manage groups in Nebula.
- Delete: Deletes the endpoint from the Nebula console. For more information, see Uninstall endpoints in Nebula.
- Download .csv: Exports the data of the selected endpoints and downloads a .csv file.
-
Download .xlsx: Exports the data of the selected endpoints and downloads a .xlsx file.
- If the data size is too large to download, an email will be sent instead with a link to download the export.
When you select an action from the Actions menu, Nebula tells the selected endpoints to perform that action as soon as possible. The amount of time needed for an endpoint to perform an action can vary. Endpoint response time depends on the type of action and how quickly the endpoint can process the action request.