> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/overview-of-the-action-center.md).

# Overview of the Action Center

The **Action Center** is a central location from which you can track the progress of all investigation, response, and maintenance actions performed on your Cortex XSIAM protected endpoints. To access the **Action Center**, go to **Investigation & Response → Response** → **Action Center**.

The main **All Actions** tab displays the most recent actions initiated in your deployment. To narrow down the results, use the table filters. You can also choose from the filtered **Action Center** views to see details of the following actions:

{% hint style="info" %}
**License note:** For actions on endpoints, you need a Cortex XSIAM Premium, or Enterprise license, or any other XSIAM license with the Enterprise Runtime Security or Cloud Runtime Security add-on.
{% endhint %}

* **File Quarantine:** View details about quarantined files on your endpoints. You can also switch to an **Aggregated by SHA256** view that collapses results per file and lists the affected endpoints in the **Scope** field.
* **Block List and Allow List:** View files that are permitted and blocked from running on your endpoints regardless of file verdict.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Blocking files on endpoints is enforced by the endpoint malware profile. To block a hash value, ensure the hash value is configured in the Malware security profile.</p><p>Select <strong>Override Report mode</strong> to allow the agent to block hashes, even if the Malware Profile is set to <strong>Report</strong>.</p></div>
* **Endpoint Isolation:** View the endpoints in your organization that have been isolated from the network. For more information, see [Isolate an endpoint](/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/isolate-an-endpoint.md).
* **External Dynamic List:** View the list of IP addresses and domain names in your EDL. For more information, see [Manage external dynamic lists](/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/response-actions/manage-external-dynamic-lists.md).
* **Endpoint Blocked IP Addresses:** View remote IP addresses that the Cortex XDR agent has automatically blocked from communicating with endpoints in your network.
* **Agent Scripts Library:** View Palo Alto Networks and administrator-uploaded scripts that you can run on your endpoints.

For actions that can take a while to complete, the **Action Center** tracks the action progress and displays the action status and current progress description for each stage. For example, after initiating an agent upgrade action, Cortex XSIAM monitors all stages from the **Pending** request until the action status is **Completed**. Throughout the action lifetime, you can view the number of endpoints on which the action was successful and the number of endpoints on which the action failed. After a period of 90 days since the action creation, the action is removed from Cortex XSIAM and is no longer displayed in the **Action Center**. You cannot delete actions manually.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-endpoints/overview-of-the-action-center.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.