{"id":5205,"date":"2026-06-29T08:00:00","date_gmt":"2026-06-29T05:00:00","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=changelog&p=5205"},"modified":"2026-10-19T11:41:31","modified_gmt":"2026-10-19T08:41:31","slug":"endpoint-security-formerly-endpoint-detection-response-2026-06-29-update","status":"publish","type":"changelog","link":"https:\/\/support.withsecure.com\/en\/changelogs\/endpoint-security-formerly-endpoint-detection-response-2026-06-29-update\/","title":{"rendered":"Endpoint Security (formerly Endpoint Detection & Response) \u2014 2026-06-29 Update"},"content":{"rendered":"

Dear community,\u00a0<\/p>\n

We are expanding the Automated actions feature in Elements EDR to help partners respond to endpoint threats faster and at scale. With this update, you can now create automated rules that trigger six new EDR response actions whenever a Broad Context Detection (BCD) is created or updated to a medium, high, or severe risk level.\u00a0<\/p>\n

What is changing?<\/strong>\u00a0<\/p>\n

Automated Actions for endpoint rules already supported Device Isolation as an automated response. We are now adding six new response actions, giving you greater flexibility to automate incident\u00a0response\u00a0across your customer\u00a0organisations.\u00a0<\/p>\n

With this update, six new response actions are available for automation:\u00a0<\/p>\n

    \n
  1. Retrieve\u00a0files<\/strong>\u00a0–\u00a0collects files from endpoints based on path patterns,\u00a0<\/li>\n
  2. Enumerate\u00a0services<\/strong>\u00a0–\u00a0lists all installed services on Windows endpoints,\u00a0<\/li>\n
  3. Retrieve browser\u00a0artefacts<\/strong>\u00a0–\u00a0collects browser history and data from major browsers,\u00a0<\/li>\n
  4. Netstat<\/strong>\u00a0– retrieves network connection information,\u00a0\u00a0<\/li>\n
  5. Enumerate scheduled tasks<\/strong>\u00a0– lists Windows scheduled tasks,\u00a0\u00a0<\/li>\n
  6. Enumerate processes<\/strong>\u00a0– lists all running processes.\u00a0<\/li>\n<\/ol>\n

    \u00a0<\/p>\n

    \"image-d896fd60bdbe78-d673.png\"<\/img><\/a><\/figure>\n

    \u00a0<\/p>\n

    How rules work<\/strong>\u00a0<\/p>\n

    When creating a rule with one of the new response actions, you choose a risk level trigger (Medium, High, or Severe) and a device scope. Rules set to “All Devices” can span multiple customer\u00a0organisations; rules scoped to “Devices with specific labels” apply to a single\u00a0organisation\u00a0only. Schedule options\u00a0remain\u00a0Continuous or Custom, and the rule type is fixed to Endpoint. As with existing rules, the rule type and response type cannot be changed after\u00a0creation,\u00a0all other fields\u00a0remain\u00a0editable.\u00a0<\/p>\n

    \u00a0<\/p>\n

    With automated EDR response actions, you can:\u00a0<\/p>\n

      \n
    • Reduce manual effort when responding to endpoint threats,\u00a0<\/li>\n
    • Ensure consistent, policy-driven responses to similar risk levels,\u00a0<\/li>\n
    • Scale security operations across many customer\u00a0organisations,\u00a0<\/li>\n
    • Focus expert attention on complex investigations rather than repetitive tasks.\u00a0<\/li>\n<\/ul>\n

      We believe this improvement will meaningfully reduce the manual burden on partners managing high volumes of endpoint\u00a0detections, and\u00a0bring the power of EDR response actions into your automated workflows.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

      Dear community,\u00a0 We are expanding the Automated actions feature in Elements EDR to help partners respond to endpoint threats faster and at scale. With this update, you can now create…<\/p>\n","protected":false},"template":"","changelog_product":[110],"class_list":["post-5205","changelog","type-changelog","status-publish","hentry"],"acf":{"release_date":"20260629","version":"","source_system":"vanilla-import","source_foreign_id":"","import_hash":"26fad76e768715a314de05a3c14f8208957f0cb0","vanilla_article_id":32981,"legacy_author":"Agnieszka","vanilla_url":"https:\/\/community.withsecure.com\/changelogs-en\/kb\/articles\/32981-endpoint-security-formerly-endpoint-detection-response-2026-06-29-update","vanilla_category_id":214,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/changelog\/5205","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/changelog"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/changelog"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=5205"}],"wp:term":[{"taxonomy":"changelog_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/changelog_product?post=5205"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}