Active Response Shell (ARS) in OneView – ThreatDown Support Portal

Active Response Shell (ARS) provides Global, Site, and Customer Administrators with secure command-line access to managed endpoints via OneView. They can use it to investigate activity, stop running processes, delete malicious files, and check network activity on an endpoint without physical access to the device. ARS also works on isolated endpoints, so admins can respond to a threat without reconnecting the device to the network.

ARS is included with Endpoint Detection and Response (EDR) and works on Windows, Windows ARM, macOS, and Linux endpoints.

User requirements

To start an ARS session, users need:

The Global. Site, or Customer Administrator role.
Multi-Factor Authentication or Single Sign-On enabled for the user.
ARS permission granted by a Global Administrator from the Configure > Users page.

Enable ARS

An admin must enable ARS in the policy assigned to the endpoint's group.

On the left navigation pane, go to Configure > Policies.
Click a policy name to edit it.
Click Endpoint Detection and Response.
Enable Active Response Shell for the desired operating systems.
Enable Enable secure connections using certificate pinning to limit which digital certificates are used with ARS, providing additional security.
Click Save.

Repeat these steps for each policy where you want ARS enabled.

Launch ARS

You can start an ARS session from three pages in OneView. Use the page that matches where you are in your investigation.

Endpoints page

Use this when you already know which endpoint you want to work on.

Go to Manage > Endpoints.
Select the checkbox next to the endpoint, or click the endpoint name to open its details.
Click Actions > Launch Active Response Shell.

Suspicious Activity page

Use this to respond to a specific detection.

Go to Investigate > Suspicious Activity.
Select the detection.
Click Actions > Launch Active Response Shell.

Flight Recorder page

Use this after you've searched endpoint activity and found a device to investigate.

Go to Investigate > Flight Recorder.
Enter your search criteria.
Click Search.
Select an endpoint from the results.
Click Actions > Launch Active Response Shell.

ARS commands

Below is the list of commands that can be run using ARS:

Windows & Windows ARM Command	Linux Command	macOS Command	Description
/?	help	help	Print a list of available commands within the remote shell window.
cd	cd	cd	Change directory or move to a specific folder.
copy	cp	cp	Copy a single file.
datetime	date	date	Show local date and time.
del	rm	rm	Delete one or more files.
dir	ls	ls	Display the list of files and folders.
diskinfo	N/A	N/A	Displays information about logical and physical drives.
dump	dump	dump	Dump binary files in hex values.
exec	exec	exec	Run a process. Background execution isn’t supported, and scripts can write files only on Windows. Examples: exec cmd exec powershell
get	get	get	Retrieve a specific file from the host machine. File size limit 512MB. The admin is prompted where to save the file on their machine.
md	mkdir	mkdir	Create a directory.
msiexec	N/A	N/A	Execute MSI installer in no-ui mode
move	mv	mv	Rename or move a file.
put	put	put	Upload a file to the host machine. File size limit 64MB.
quit	quit	quit	Terminate ARS.
reg	N/A	N/A	Performs operations on registry subkey, information, and values in the registry. Examples: reg query reg delete
sandbox	N/A	N/A	Upload the file to Sandbox Analysis.
sc	systemctl	launchctl	Performs operations with the Service Control Manager.
systeminfo	systeminfo	systeminfo	Displays operating system information for the local host machine.
taskkill	kill	kill	Terminate one or more processes from PID or process name. Example: taskkill /pid <PID> /F
tasklist	ps	ps	Display a list of active processes.
timeliner	N/A	N/A	Execute the Forensic Timeliner.
type	cat	cat	Displays the contents of a text file or files.
unzip	unzip	unzip	Unzip the archived folder.
zip	zip	zip	Compress a list of files and folders in a ZIP archive.