---
title: "Security Operations Actions in Endpoint Detection"
slug: "security-operations-actions-in-endpoint-detection"
updated: 2025-09-17T20:01:38Z
published: 2025-09-17T20:01:38Z
canonical: "support.kandji.io/security-operations-actions-in-endpoint-detection"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Operations Actions in Endpoint Detection

### What are Security Operations actions?

Security Operations (SecOps) actions are the controls available in an endpoint security or EDR workflow that let administrators review detections and take follow-up steps such as updating status, investigating details, or performing response tasks within the security console. In Kandji Endpoint Detection & Response, these actions are surfaced on the Threats page and include updating the detection's Status to track progress through review and remediation.

### Using SecOps Actions in EDR

The **Status** action on the Threats page of Endpoint Detection lets you track and update detection events as you work through them. As an admin, you can manually mark detections as **Open** or **Closed**, while Kandji automatically assigns other statuses based on timing, such as when the detection first occurred or how long it's been resolved. This creates a consistent workflow that helps you see what's new, what needs attention, and what's been handled, making it easier to triage threats and track progress across your fleet.

The **Status** column is available in both **File Detection** and **Behavioral Detection** tables.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0236PM@2x(1).png)

### Status Types

Detection events can have one of four statuses:

- **New** – Occurred within the last 24 hours.
- **Open** – Not yet marked as closed.
- **Closed** – Resolved by manually marking as Closed.
- **Archived** – Closed for more than 30 days.

**Automatic management:** The **New** and **Archived** statuses are set automatically by Kandji. You can manually change a detection between **Open** and **Closed**.

### Filtering by Status

You can filter detection events by status on the *Threats* page:

- **Event filter** – By default, shows **New**, **Open**, and **Closed** events. **Archived** events are hidden unless selected.
- **Device filter** – Located in the side panel, allows filtering devices by **Open** or **Closed** detections.

### Changing Detection Status

> [!NOTE]
> Updating statuses regularly helps keep detection lists accurate and improves filtering for active threats.

To change the status of one or more detections:

1. Select the detection(s) using the checkbox.
2. Click **Change Status** in the action bar.
3. Choose the new status from the dropdown menu.
4. Click **Change** to apply.

You can update detections individually or in bulk.

### Tags for Threat Organization

Tags provide a flexible way to organize, filter, and manage threats based on your team's specific operational needs. These admin-defined tags streamline threat management and enhance collaboration by allowing you to categorize detections with custom labels that align with your workflow.

The threats page now includes a Tags column, giving you visibility into which tags are associated with each threat. If a threat has multiple tags, you can hover over the column to see the full list.

### Working with Tags

#### Creating and Removing Tags

You have full control over your tags. To create, modify, or delete tags, click the **Manage Tags** button. This allows you to customize and maintain a tagging system that aligns with your team's operational needs.

To create a new tag:

1. Select the **Manage Tags** icon in the upper right-hand corner of the Threats page.
2. Click **Add Tag**.
3. Enter your desired **tag text**. Select the **checkmark** to save, and repeat as desired for the number of tags you want to add.
4. **Close** the modal.

**![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0239PM@2x.png)**

To edit a tag:

1. Select the **Manage Tags** icon in the upper right-hand corner of the Threats page.
2. Click the **pencil** **icon** next to the tag you want to edit.
3. Update the **tag text**, then click the **check**.
4. **Close** the modal.

To delete a tag:

1. Select the **Manage Tags** icon in the upper right-hand corner of the Threats page.
2. Select the **Trash** icon to the right of the threat.
3. **Close** the modal.

#### Assigning Tags to Threats

To assign a tag to a threat:

1. Select one or more **threats** from the list.
2. Click on the **ellipses** in the lower left corner.
3. Select **Assign Tags**, and select your tags from the list.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0406PM@2x.png)

### Filtering by Tags

You can filter the threats table by selecting one or more tags from the top filter. This helps you focus on specific types of threats or tasks.