Scan response action [ESS] (#5563)

* Update features privileges page * Update response actions page * Update response actions page (serverless) * li'l edit * 'nother li'l edit * Revert change to serverless file * Apply suggestions from Nastasha's review Co-authored-by: Nastasha Solomon <[email protected]> --------- Co-authored-by: Nastasha Solomon <[email protected]> (cherry picked from commit 26aee2a)
elastic · Jul 25, 2024 · 5db9483 · 5db9483
1 parent d4c8c58
commit 5db9483
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 0 deletions.
diff --git a/docs/getting-started/defend-feature-privs.asciidoc b/docs/getting-started/defend-feature-privs.asciidoc
@@ -57,6 +57,9 @@ To grant access, select *All* for the *Security* feature in the *{kib} privilege
 a| Perform shell commands and script-related <<response-actions,response actions>> in the response console.
 
 WARNING: The commands are run on the host using the same user account running the {elastic-defend} integration, which normally has full control over the system. Only grant this feature privilege to {elastic-sec} users who require this level of access.
+
+| *Scan Operations*
+| Perform folder scan <<response-actions,response actions>> in the response console.
 |==============================================
 
 [discrete]

diff --git a/docs/getting-started/images/endpoint-privileges.png b/docs/getting-started/images/endpoint-privileges.png
diff --git a/docs/management/admin/response-actions.asciidoc b/docs/management/admin/response-actions.asciidoc
@@ -173,6 +173,19 @@ TIP: You can follow this with the `execute` response action to upload and run sc
 
 NOTE: The default file size maximum is 25 MB, configurable in `kibana.yml` with the `maxUploadResponseActionFileBytes` setting. You must enter the value in bytes (the maximum is `104857600` bytes, or 100 MB).
 
+[discrete]
+=== `scan`
+
+Scan a specific file or directory on the host for malware. The scan uses the <<malware-protection,malware protection settings>> (such as **Detect** or **Prevent** options, or enabling the blocklist) as configured in the host's associated {elastic-defend} integration policy. Use these parameters:
+
+* `--path` : (Required) The absolute path to a file or directory to be scanned.
+
+Required privilege: *Scan Operations*
+
+Example: `scan --path "/Users/username/Downloads" --comment "Scan Downloads folder for malware"`
+
+NOTE: Scanning can take longer for directories containing a lot of files.
+
 [discrete]
 [[supporting-commands-parameters]]
 == Supporting commands and parameters