Ransomware isolation automation

CraigV123 — Thu, 15 Aug 2024 20:13:55 GMT

Hi everyone.

Have XDR Pro. Looking for an "easy" way to automatically isolate a device when ransomware-like behaviors are detected. Looking through the automation configurations, it doesn't appear to be that easy. I obviously don't want to be isolating a ton of devices on false positives either.

Any suggestions from the community?

Thanks in advance.

Re: Ransomware isolation automation

jmazzeo — Fri, 16 Aug 2024 12:56:15 GMT

Hi @CraigV123, thanks for reaching us using the Live Community.

The Automation Rules are the way to isolate the endpoints on a critical event like this. You need to create the rule as detailed as possible, like Severity = High or Critical & Category contains Malware + you can add the Mitre Tactics and Techniques usually used for this kind of malware.

Of course the best option is to have an alert about this kind of malware and create the filter using the current findings.

If this post answers your question, please mark it as the solution.

topic Re: Ransomware isolation automation in Cortex XDR Discussions

Ransomware isolation automation

Re: Ransomware isolation automation