Response Actions

As a result of an incident investigation, different response actions are possible.
After or during the investigation of malicious activity in your network, Cortex XDR offers various response actions that enable you investigate the endpoint and take immediate action to remediate it. For example, when you detect a compromised endpoint, you can isolate it from your network to prevent it from communicating with any other internal or external device and thereby reducing an attacker’s mobility on your network. The available response actions in Cortex XDR are:
For response actions that rely on a Cortex XDR agent, the following table describes the supported platforms and minimal agent version. A dash (—) indicates the setting is not supported.
Initiate a Live Terminal Session
Initiates a remote connection to an endpoint allowing you to investigate and respond to security events on endpoints. Using
Live Terminal
you can navigate and manage files in the file system, manage active processes, and run the operating system or Python commands.
Cortex XDR agent 6.1 and later
Cortex XDR agent 7.0 and later
Cortex XDR agent 7.0 and later
Isolate an Endpoint
Halts all network access on the endpoint except for traffic to Cortex XDR to prevent a compromised endpoint from communicating with any other internal or external device.
Cortex XDR agent 6.0 and later
Cortex XDR agent 7.3 and later on macOS 10.15.4 and later
Response actions are not supported for Android endpoints.

Recommended For You