{"id":7334,"date":"2026-04-22T10:01:24","date_gmt":"2026-04-22T07:01:24","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=announcement&p=7334"},"modified":"2026-10-19T13:11:37","modified_gmt":"2026-10-19T10:11:37","slug":"windows-arm64-response-actions-support-now-available","status":"publish","type":"announcement","link":"https:\/\/support.withsecure.com\/fr\/announcements\/windows-arm64-response-actions-support-now-available\/","title":{"rendered":"Windows ARM64: Response Actions Support Now Available\u00a0"},"content":{"rendered":"

We are pleased to announce that\u00a0response actions are now supported on Windows ARM64 systems<\/strong>.\u00a0<\/p>\n

Windows ARM64 support has already been available for the\u00a0Endpoint Protection Platform (EPP)<\/strong>\u00a0and the\u00a0EDR sensor<\/strong>. With this update, response capabilities are extended to Windows ARM64 endpoints, completing functional parity with other supported Windows architectures for Endpoint Detection and Response (EDR).\u00a0For more information on Response Actions, please check the User Guide<\/a>.\u00a0<\/p>\n

As a result,\u00a0Windows on ARM64 now has full EDR coverage<\/strong>, including prevention, detection, investigation, and response.\u00a0<\/p>\n

\u00a0<\/p>\n

Supported Windows Response Actions on ARM64<\/strong>\u00a0<\/h2>\n

The following\u00a0Windows response actions<\/strong>\u00a0are available on Windows\u00a0ARM64\u00a0endpoints.\u00a0<\/p>\n

Investigative actions<\/strong>\u00a0<\/p>\n

    \n
  • Collect forensics package\u00a0<\/li>\n
  • Enumerate processes\u00a0<\/li>\n
  • Enumerate scheduled tasks\u00a0<\/li>\n
  • Enumerate services\u00a0<\/li>\n
  • Enumerate WMI persistence\u00a0<\/li>\n
  • Map file system\u00a0<\/li>\n
  • Map registry\u00a0<\/li>\n
  • Netstat\u00a0<\/li>\n
  • Process memory dump\u00a0<\/li>\n
  • Retrieve\u00a0Amcache\u00a0<\/li>\n
  • Retrieve antivirus log files\u00a0<\/li>\n
  • Retrieve browser artefacts\u00a0<\/li>\n
  • Retrieve event log\u00a0entries\u00a0<\/li>\n
  • Retrieve event log files\u00a0<\/li>\n
  • Retrieve event log tracing entries\u00a0<\/li>\n
  • Retrieve files\u00a0<\/li>\n
  • Retrieve folders\u00a0<\/li>\n
  • Retrieve\u00a0jumplist\u00a0files\u00a0<\/li>\n
  • Retrieve master boot record (MBR)\u00a0<\/li>\n
  • Retrieve master file table (MFT)\u00a0<\/li>\n
  • Retrieve Prefetch\u00a0<\/li>\n
  • Retrieve recently accessed\u00a0<\/li>\n
  • Retrieve registry hives\u00a0<\/li>\n
  • Retrieve remote desktop protocol cache files (RDP)\u00a0<\/li>\n
  • Retrieve System resource usage monitoring database (Scrumdb)\u00a0<\/li>\n
  • Retrieve PowerShell history\u00a0<\/li>\n
  • Test Connections\u00a0<\/li>\n<\/ul>\n

    Containment and remediation actions<\/strong>\u00a0<\/p>\n

      \n
    • Kill process\u00a0<\/li>\n
    • Kill thread\u00a0<\/li>\n
    • Delete file\u00a0<\/li>\n
    • Delete registry\u00a0<\/li>\n
    • Delete scheduled tasks\u00a0<\/li>\n
    • Delete services\u00a0<\/li>\n
    • Delete WMI persistence\u00a0<\/li>\n<\/ul>\n

      Not Supported on Windows ARM64<\/strong>\u00a0<\/p>\n

      The following response action is\u00a0not supported<\/strong>\u00a0on Windows ARM64\u00a0at this time:\u00a0<\/p>\n

        \n
      • Full Memory Dump\u00a0<\/li>\n<\/ul>\n

        All other Windows response actions listed above are supported and available for use on ARM64 systems.\u00a0<\/p>\n

        \u00a0<\/p>\n

        Important\u00a0note on ARM64 Channel Subscription<\/strong>\u00a0<\/h2>\n

        If you\u00a0encounter\u00a0issues after\u00a0subscribing\u00a0an endpoint to the\u00a0ARM64 channel<\/strong>, a\u00a0restart of the client<\/strong>\u00a0may\u00a0be required\u00a0to ensure that the updated components and response capabilities are fully activated.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

        We are pleased to announce that\u00a0response actions are now supported on Windows ARM64 systems.\u00a0 Windows ARM64 support has already been available for the\u00a0Endpoint Protection Platform (EPP)\u00a0and the\u00a0EDR sensor. With this…<\/p>\n","protected":false},"template":"","announcement_category":[142],"class_list":["post-7334","announcement","type-announcement","status-publish","hentry"],"acf":{"source_system":"vanilla-import","import_hash":"182ed81bf572f7fc3b932ce7538952351bd9c105","vanilla_article_id":32905,"legacy_author":"AndyF_WS","vanilla_url":"https:\/\/community.withsecure.com\/announcements-en\/kb\/articles\/32905-windows-arm64-response-actions-support-now-available","vanilla_category_id":142,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/announcement\/7334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/types\/announcement"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/announcement\/7334\/revisions"}],"predecessor-version":[{"id":8862,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/announcement\/7334\/revisions\/8862"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/media?parent=7334"}],"wp:term":[{"taxonomy":"announcement_category","embeddable":true,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/announcement_category?post=7334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}