Ransomware isolation automation

[CraigV123]

Hi everyone.

Have XDR Pro. Looking for an "easy" way to automatically isolate a device when ransomware-like behaviors are detected. Looking through the automation configurations, it doesn't appear to be that easy. I obviously don't want to be isolating a ton of devices on false positives either.

Any suggestions from the community?

Thanks in advance.

[jmazzeo]

Hi @CraigV123, thanks for reaching us using the Live Community.

The Automation Rules are the way to isolate the endpoints on a critical event like this. You need to create the rule as detailed as possible, like Severity = High or Critical & Category contains Malware + you can add the Mitre Tactics and Techniques usually used for this kind of malware.

Of course the best option is to have an alert about this kind of malware and create the filter using the current findings.

If this post answers your question, please mark it as the solution.