> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-endpoints/overview-of-the-action-center.md). # Overview of the Action Center The **Action Center** is a central location from which you can track the progress of all investigation, response, and maintenance actions performed on your Cortex XDR protected endpoints. The main **All Actions** tab displays the most recent actions initiated in your deployment. To narrow down the results, use the table filters. You can also choose from the filtered **Action Center** views to see details of the following actions: * **File Quarantine:** View details about quarantined files on your endpoints. You can also switch to an **Aggregated by SHA256** view that collapses results per file and lists the affected endpoints in the **Scope** field. * **Block List and Allow List:** View files that are permitted and blocked from running on your endpoints regardless of file verdict.

Note

Blocking files on endpoints is enforced by the endpoint malware profile. To block a hash value, ensure the hash value is configured in the Malware security profile.

Select Override Report mode to allow the agent to block hashes, even if the Malware Profile is set to Report.

* **Endpoint Isolation:** View the endpoints in your organization that have been isolated from the network. For more information, see [Isolate an endpoint](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/response-actions/isolate-an-endpoint.md). * **Endpoint Blocked IP Addresses:** View remote IP addresses that the Cortex XDR agent has automatically blocked from communicating with endpoints in your network. For actions that can take a while to complete, the **Action Center** tracks the action progress and displays the action status and current progress description for each stage. For example, after initiating an agent upgrade action, Cortex XDR monitors all stages from the **Pending** request until the action status is **Completed**. Throughout the action lifetime, you can view the number of endpoints on which the action was successful and the number of endpoints on which the action failed. After a period of 90 days since the action creation, the action is removed from Cortex XDR and is no longer displayed in the **Action Center**. You cannot delete actions manually. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/investigate-and-respond-to-incidents/investigate-endpoints/overview-of-the-action-center.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.