{"id":4983,"date":"2025-10-30T08:00:00","date_gmt":"2025-10-30T06:00:00","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=changelog&#038;p=4983"},"modified":"2026-10-19T12:19:56","modified_gmt":"2026-10-19T09:19:56","slug":"elements-api-2025-10-30-update","status":"publish","type":"changelog","link":"https:\/\/support.withsecure.com\/en\/changelogs\/elements-api-2025-10-30-update\/","title":{"rendered":"Elements API &#8211; 2025-10-30 Update"},"content":{"rendered":"<h2 data-id=\"new-response-actions-to-enable-new-workflows\">New response actions to enable new workflows<\/h2>\n<p>We&#8217;ve added new response action endpoints under <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">POST \/response-actions\/v1\/execute\/&lt;name&gt;<\/code> to expand remote execution capabilities for both device and identity management.<\/p>\n<p>This allows you to automate new workflows that involve acting on the target devices and identities.<\/p>\n<p>This release increases the number of API supported response actions from 8 to 32.<\/p>\n<h3 data-id=\"device-response-actions\">Device response actions<\/h3>\n<p>The following device response actions are available:<\/p>\n<ul>\n<li><strong>Create full memory dump<\/strong> &#8211; Uploads a full memory dump from the device<\/li>\n<li><strong>Delete registry key or value<\/strong> &#8211; Deletes a specified Windows registry key or value<\/li>\n<li><strong>Delete scheduled task<\/strong> &#8211; Deletes a specified Windows scheduled task<\/li>\n<li><strong>Delete Windows service<\/strong> &#8211; Deletes a specified Windows service<\/li>\n<li><strong>Delete WMI persistence objects<\/strong> &#8211; Deletes Windows Management Instrumentation (WMI) persistence objects<\/li>\n<li><strong>Enumerate running processes<\/strong> &#8211; Enumerates running processes on the device<\/li>\n<li><strong>Enumerate WMI persistence mechanisms<\/strong> &#8211; Enumerates WMI persistence mechanisms, including event consumers, filters, and bindings<\/li>\n<li><strong>List file system structure<\/strong> &#8211; Lists the file system structure based on path matching patterns<\/li>\n<li><strong>List registry keys and values<\/strong> &#8211; Lists Windows registry keys and values based on path matching patterns<\/li>\n<li><strong>List scheduled tasks<\/strong> &#8211; Lists all Windows scheduled tasks on the device<\/li>\n<li><strong>Retrieve amcache files<\/strong> &#8211; Retrieves the application compatibility cache file from the device<\/li>\n<li><strong>Retrieve antivirus logs<\/strong> &#8211; Retrieves antivirus software log files for security analysis<\/li>\n<li><strong>Retrieve browser artifacts<\/strong> &#8211; Retrieves the browser history from the device<\/li>\n<li><strong>Retrieve event log tracing files<\/strong> &#8211; Retrieves .etl event log tracing files with records of system activities<\/li>\n<li><strong>Retrieve files from device<\/strong> &#8211; Retrieves files from the device based on path matching patterns<\/li>\n<li><strong>Retrieve jump list files<\/strong> &#8211; Retrieves jump lists stored in the AutomaticDestinations and CustomDestinations subfolders<\/li>\n<li><strong>Retrieve master boot record<\/strong> &#8211; Retrieves the master boot record (MBR) from a specified drive<\/li>\n<li><strong>Retrieve master file table<\/strong> &#8211; Retrieves the master file table (MFT) from a specified drive<\/li>\n<li><strong>Retrieve network connections<\/strong> &#8211; Retrieves network connections, routing tables, interface statistics, and related process information<\/li>\n<li><strong>Retrieve prefetch files<\/strong> &#8211; Retrieves Windows prefetch files with evidence of program execution<\/li>\n<li><strong>Retrieve process memory dump<\/strong> &#8211; Retrieves a memory dump of a specific process<\/li>\n<li><strong>Retrieve RDP cache files<\/strong> &#8211; Retrieves remote desktop protocol (RDP) bitmap cache files<\/li>\n<li><strong>Retrieve recently accessed files<\/strong> &#8211; Retrieves information about recently accessed files and folders from user activity artefacts<\/li>\n<li><strong>Retrieve registry hive files<\/strong> &#8211; Retrieves Windows registry hive files<\/li>\n<li><strong>Retrieve SRUM database<\/strong> &#8211; Retrieves the system resource usage monitor (SRUM) database<\/li>\n<li><strong>Retrieve Windows event log entries<\/strong> &#8211; Retrieves Windows event log entries based on specified filters<\/li>\n<li><strong>Retrieve Windows event log files<\/strong> &#8211; Retrieves Windows event log files<\/li>\n<li><strong>Terminate process<\/strong> &#8211; Terminates processes matching the specified patterns<\/li>\n<li><strong>Terminate thread<\/strong> &#8211; Terminates a thread<\/li>\n<\/ul>\n<h3 data-id=\"identity-response-actions\">Identity response actions<\/h3>\n<p>The following identity response actions are available for Microsoft Entra:<\/p>\n<ul>\n<li><strong>Block user access in Microsoft Entra<\/strong> &#8211; Blocks access for a user to all resources inside the Microsoft Entra ecosystem<\/li>\n<li><strong>End Microsoft Entra session<\/strong> &#8211; Ends the Microsoft Entra session of a user<\/li>\n<li><strong>Reset Microsoft Entra password<\/strong> &#8211; Resets the Microsoft Entra password of a user<\/li>\n<\/ul>\n<h3 data-id=\"response-action-results-and-attachments\">Response action results and attachments<\/h3>\n<p>Response actions are processed asynchronously: once triggered, you can monitor their progress.A new endpoint is available for retrieving the actual results of response actions that return data (for example, memory dumps or other files):<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">GET\u00a0\/response-actions\/v1\/responses\/tasks<\/code><\/p>\n<p>By using this endpoint, you can download any files or attachments produced by completed response actions. To determine when your action has finished, first poll the state via <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">GET\u00a0\/response-actions\/v1\/responses<\/code>. When the action is marked as finished, your attachments are ready for download from the tasks endpoint.<\/p>\n<h3 data-id=\"start-building\">Start building<\/h3>\n<p>Full API documentation is available at <span class=\"js-embed embedResponsive inlineEmbed\"><br \/>\n    <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fconnect.withsecure.com%2Fapi-reference%2Felements%2F\" rel=\"nofollow noopener ugc\" target=\"_blank\"><br \/>\n        https:\/\/connect.withsecure.com\/api-reference\/elements\/<br \/>\n    <\/a><br \/>\n<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>New response actions to enable new workflows We&#8217;ve added new response action endpoints under POST \/response-actions\/v1\/execute\/&lt;name&gt; to expand remote execution capabilities for both device and identity management. This allows you&hellip;<\/p>\n","protected":false},"template":"","changelog_product":[128],"class_list":["post-4983","changelog","type-changelog","status-publish","hentry"],"acf":{"release_date":"20251030","version":"","source_system":"vanilla-import","source_foreign_id":"","import_hash":"7d52120f92d30c69c1b5696c389580fc5ff141ef","vanilla_article_id":32730,"legacy_author":"ArtoV","vanilla_url":"https:\/\/community.withsecure.com\/changelogs-en\/kb\/articles\/32730-elements-api-2025-10-30-update","vanilla_category_id":170,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/changelog\/4983","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/changelog"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/changelog"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4983"}],"wp:term":[{"taxonomy":"changelog_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/changelog_product?post=4983"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}