Ransomware isolation automation

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Ransomware isolation automation

L3 Networker

Hi everyone.

Have XDR Pro. Looking for an "easy" way to automatically isolate a device when ransomware-like behaviors are detected. Looking through the automation configurations, it doesn't appear to be that easy. I obviously don't want to be isolating a ton of devices on false positives either.

 

Any suggestions from the community?

 

Thanks in advance.

1 REPLY 1

L4 Transporter

Hi @CraigV123, thanks for reaching us using the Live Community.

 

The Automation Rules are the way to isolate the endpoints on a critical event like this. You need to create the rule as detailed as possible, like Severity = High or Critical & Category contains Malware + you can add the Mitre Tactics and Techniques usually used for this kind of malware.

Of course the best option is to have an alert about this kind of malware and create the filter using the current findings.

 

If this post answers your question, please mark it as the solution.

JM
  • 289 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!