> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/overview-of-the-action-center/action-center-reference-information.md). # Action Center reference information The following table describes both the default and additional optional fields that you can view from the **All Actions** tab of the **Action Center** and lists the fields in alphabetical order.

Field	Description
Action Type	Type of action initiated on the endpoint.
Agent Restart	Status of the restart action on the endpoint. Statuses: In progress: Action initiated, but no start indication from agent after stop. Failed: Agent reports failed back to the Cortex Cloud server if it was started after more than 10 minutes after restart initiation. Expired: After 4 days. Success: Agent reports success to the Cortex Cloud server if it was started within 10 minutes after restart initiation.
Created By	Name of the user who initiated the action.
Creation Timestamp	Date and time the action was created.
Description	Action scope of affected endpoints and additional data relevant to each of the specific actions, such as agent version, file path, and file hash.
Expiration Date	Time the action will expire. To set an expiration date, the action must apply to one or more endpoints. By default, Cortex Cloud assigns a 30-day expiration limit to the following actions: Agent Uninstall Agent Upgrade Files Retrieval Isolate Cancel Endpoint Isolation Additional actions such as malware scans, quarantine, and endpoint data retrieval are assigned a 4-day expiration limit. After the expiration limit, the status for any remaining Pending actions on endpoints change to Expired and these endpoints will not perform the action.
Status	Current status of the action.
	Additional data: If additional details are available for an action or for specific endpoints, you can pivot to the Additional data view. You can also export the additional data to a TSV file. The page can include details in the following fields but varies depending on the type of action.
Endpoint Name	Target host name of each endpoint for which an action was initiated.
IP Addresses	IP address associated with the endpoint.
Status	Status of the action for the specific endpoint. (Linux)—Completed with Partial Success for a single endpoint that did not complete the action successfully.
Action Last Update	Time at which the last status update occurred for the action.
Advanced Analysis	For Retrieve issue data requests related to Cortex Cloud issues triggered by exploit protection modules, Cortex Cloud can analyze the memory state for additional verdict verification. This field displays the analysis progress and resulting verdict.
Action Parameters	Summary of the action including the issue name and ID.
Additional Data \| Malicious Files	Additional data, if any is available, for the action. For malware scans, this field is titled Malicious Files and indicates the number of malicious files identified during the scan.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/investigate-endpoints/overview-of-the-action-center/action-center-reference-information.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.