Views:

Specify how long Response Management waits before each response action times out.

Time-out settings control how long TrendAI Vision One™ waits for each response action to finish before marking the task as timed out. When a response action does not return a result from the target within the configured time-out period, the task status changes to Unsuccessful and shows a time-out error.
When a response action exceeds its configured time-out period:
  • The task status changes to Unsuccessful with a time-out error on the Response data tab.
  • If a playbook triggered the action, the playbook follows any configured failure path.
  • No rollback occurs. If part of the action already ran on the target, that partial state remains.
  • You can retry the action manually from the Response data tab.
Configure time-out values to account for your network conditions, endpoint availability, and organizational policies. Shorter time-out periods surface failures sooner; longer time-out periods give slow-responding or offline endpoints more time to finish.
If a specific action times out frequently, confirm the target endpoint is online with a healthy agent connection before you increase the time-out value.

Procedure

  1. Go to Workflow and Automation → Response Management and click the Settings tab.
  2. Click Edit settings in Time-out settings.
    If you see only View settings, you lack the necessary permissions to edit the settings.
  3. Select a time-out period for each response action. If left unspecified, TrendAI Vision One™ uses the default setting.
  4. To restore the default settings, click Reset defaults.

Time-out settings reference

Definitions

Term
Definition
Command delivery time-out
Maximum time Response Management waits for the target agent or service to acknowledge and complete a response action. If the target does not respond within this window, the task times out and its status changes to Unsuccessful. This is the value you configure in Time-out settings.
Queued task time-out
Maximum time a task remains queued when the target endpoint is offline. If the endpoint does not come back online within this window, the queued task is canceled automatically.
Remote shell connection time-out
Maximum time to establish an initial remote shell connection to the endpoint before the connection attempt fails
Remote shell session time-out
Maximum duration of an active remote shell session. The session ends when this limit is reached.
Remote shell inactivity time-out
Idle time allowed before an active remote shell session is disconnected automatically because of no user activity

Default time-out values

Endpoint response actions

Response action
XDR Endpoint Sensor
Apex One Endpoint Sensor
Cloud One Workload Security
Notes
Remote Shell
6 min
6 min
6 min
Connection-establishment time-out only; session and inactivity time-outs are separate.
Isolate / Restore Endpoint
24 hr
25 min
65 min
The XDR Endpoint Sensor time-out is longer because tasks are queued for offline agents.
Terminate Process
6 min
25 min
N/A
XDR Endpoint Sensor uses Remote Shell internally to terminate the process.
Add to Block List
N/A
5 min
5 min
Server-side operation; does not require agent communication for XDR Endpoint Sensor.
Collect File
24 hr
12 hr
12 hr
The long time-out accounts for large file transfers and slow network conditions.
Custom Script Execution
24 hr
N/A
12 hr
Apex One Endpoint Sensor does not support custom scripts.
Memory Dump
24 hr
N/A
N/A
XDR Endpoint Sensor only; creates a full process memory dump
Submit to Sandbox
12 hr
12 hr
12 hr
Includes file upload and sandbox analysis time

Email response actions

Response action
Cloud App Security
Notes
Quarantine / Restore / Delete Email
50 min
Communicates with the mail provider API, such as Exchange Online or Gmail

Identity response actions

Response action
Entra ID
Notes
Disable User Account
10 min
All identity actions share the same time-out and use the Microsoft Graph API.
Enable User Account
10 min
Force Sign Out
10 min
Force Password Reset
10 min
Comments (0)