Containment and remediation use case

Note

Host: describes a computer, server, device or other endpoint system on the network.

Containment: refers to the response focused on the entire host endpoint to block communication with other host endpoints to prevent the spread of the threat.

Quarantine: is the specific EDR reaction used to achieve host containment disconnecting the device from the network.

1. You can choose to contain and then remediate the threat, or you can choose for immediate remediation. Your choice will depend on whether the device can be taken offline or not. Containing the threat prior to remediation ensures that the full scope of the attack is established, which provides time to develop a tailored successful remediation strategy.

   • Containment: use to contain the device by suspending its access to and from network traffic, therefore preventing the threat from spreading to other devices in the environment, while you continue to investigate the threat.

   • Immediate remediation: use when the device is a critical network component and cannot be taken off the network as the implications of taking the device off the network are too severe.

     Caution

     Immediate remediation may not successfully address all remnants of the threat, and consequently result in complicating the threat landscape.

2. Quarantine the device: if there is evidence of lateral movement of the threat within the device, the analyst will quarantine the device to prevent lateral movement from the device. To suspend network access to and from a device, contain the affected device using Quarantine device.

   Note

   To enable continued investigation and remote access during quarantine, the endpoint retains connectivity with the Endpoint Security and DMZ servers that manage it, as well as any IP addresses defined in the containment allow list.

3. Continue the investigation with retained connectivity between the endpoint and the Endpoint Security server.

4. Monitor for a new threat as containment of the threat may alert the attacker, causing them to employ a new approach.

5. Preserve the investigation case for further analysis.

6. Remediate the threat, using one or more of the following remediation reactions that you can execute remotely:

   Remediation device reactions

   Device	Device	Device
   Remove file: to remove a file, a trusted file, or a critical file from the endpoint, use Remove file.	Delete Windows registry value: to delete a Windows registry value, use Delete registry value.	Host Remediation: to remotely connect to endpoints and execute commands using the command line interface.
   Remove file safe: to remove a non-critical, or non-trusted file from the endpoint, use Remove file safe.	Schedule reboot: to force an endpoint restart due to a process blocking a file deletion, use Schedule reboot.	End quarantine device: to end the quarantine session when the threat is eradicated, use the End quarantine device feature to reconnect the device to the network.
   Delete folder: to delete a folder used by the threat, use Delete folder.	Execute reboot operating system: to execute an immediate system reboot without saving any work or application, use Reboot operating system.
   	Execute shutdown operating system: to clean the endpoint memory of the threat process, use Execute shutdown operating system.

   
   
   
   Remediation process reactions

   Process	Process
   Stop process: to contain a process use Stop process.	Stop and remove file safe: to stop a process and remove a non-critical, non-trusted file from the endpoint, use Stop and remove file safe.
   Kill process: to contain a threat process and child processes, use Kill process.	Stop and remove content: to stop interpreter processes such as Python and Bash and remove the associated script, use Stop and remove content.
   Custom IOC: To create a custom reaction tailored to a specific managed endpoint, use the Create a custom reaction feature.	Stop and remove process: to stop and permanently remove a threat process and child process, use Stop and remove process.

   
   
   
   Remediation user reaction

   Execute user logoff: to terminate a user's session due to suspicious behavior, use Execute user logoff.

   
   
   

7. To verify that the threat and any remanets are completely eradicated, select from the following checks:

   • Check the Action history dashboard to ensure that the status of the affected artifacts are Complete.

   • Check the Monitoring dashboard and the Alerting dashboard for the eradicated threat.

   • Review the Threat Event Log for recent events originating from the remediated endpoint.

   • Review the Process Activity pane and the Knowledge Graph to ensure that the parent and child processes associated with the threat are not present.

   • Note

     Trellix Wise our generative AI search is integrated with Real-Time Search, Device Search and Historical Search.

   • Use Enterprise Search for specific indicators of compromise (IOCs) related to the eradicated threat.

   • Use Real-time Search to run expressions or queries on the affected endpoints to confirm the malicious process is not running.

   • Use Device Search to look for the process id (PID), network and DNS connections, hostname, IP address, user, and any new alerts on the affected endpoint.

   • Use Historical Search to look at endpoint traces and telemetry to confirm that the initial analysis captured the full scope of the attack, and the root cause was successfully addressed.

8. Confirm that the threat is eradicated, update the investigation report.