---
title: "Use the Response Actions Plugin"
slug: "response-actions"
updated: 2026-09-10T17:19:07Z
published: 2026-09-10T17:19:07Z
canonical: "docs.redcanary.com/response-actions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use the Response Actions Plugin

## Response Actions

The response actions plugin introduces the functionality of running actions on a Linux endpoint triggered in response to threats, as well as within the Zscaler MDR portal Automations feature.

The plugin is disabled by default. When you install the Linux Endpoint Detection and Response (EDR) sensor with the “Deploy Sensors” instructions in your portal, there is no code shipped that allows the sensor to perform any actions whatsoever on the endpoint. The response actions plugin must be explicitly enabled from within your Zscaler MDR portal to receive this functionality.

## Response Action: File Retrieval and Deletion

The first action supported by the Response Actions plugin is **File Retrieval** and **File Deletion**. You can trigger this action in response to a threat from your Zscaler MDR portal. When you use the file retrieval functionality, you will receive an email with a download link to retrieve your file from the Zscaler MDR portal. When you use the file deletion functionality, the sensor will delete the relevant file based on the path provided in the threat.

## How to use Response Actions

1. Click **Threats** from the navigation menu, and choose the relevant threat. On the top right click **Respond**.

![Respond_Button_Linux_New.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/11576538593559.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A02Z&se=2026-11-09T13%3A08%3A02Z&sr=c&sp=r&sig=s5%2FJZybXaAidvqfyj4%2BAofYYZWQ686kWZgKbsMMzhMs%3D)
2. The response actions you can take will appear on the right side of the threat details.

![RetrieveDeleteFileButtonNew.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/11576590774167.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A02Z&se=2026-11-09T13%3A08%3A02Z&sr=c&sp=r&sig=s5%2FJZybXaAidvqfyj4%2BAofYYZWQ686kWZgKbsMMzhMs%3D)
3. Click **Review & Execute** and confirm the action.

![ReviewandExecuteButtonNew.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/11576593090711.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A02Z&se=2026-11-09T13%3A08%3A02Z&sr=c&sp=r&sig=s5%2FJZybXaAidvqfyj4%2BAofYYZWQ686kWZgKbsMMzhMs%3D)
4. The Automate On Demand Playbook window opens, displaying which actions will be performed. Click **Approve & Execute** to confirm the operation.

![ApproveNew.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/11576563204247.png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A02Z&se=2026-11-09T13%3A08%3A02Z&sr=c&sp=r&sig=s5%2FJZybXaAidvqfyj4%2BAofYYZWQ686kWZgKbsMMzhMs%3D)

For more information about playbooks, see [Understand Playbook Features and Attributes](/doc/docs/playbook-features-and-attributes).