A security analyst inspecting telemetry from an Endpoint Detection and Response (EDR) system observes an unapproved administrative utility downloading an encoded payload from an external domain, followed by an immediate attempt to modify host boot configurations. Which of the following is the MOST effective immediate action the analyst should take using the EDR platform to contain the incident?
- Perform host-level network isolation via the EDR console while keeping the management channel open for live investigation.Answer
- BUpdate perimeter firewall rules to block traffic from the external domain across the corporate network boundary.
- CDistribute an updated virus signature definition file to the host antivirus agent to clean the malicious binaries.
- DSchedule an immediate system patch update and automated reboot on the affected host to close open vulnerabilities.
Answer
Initiating host-level network isolation via the EDR console while retaining agent management connectivity is the most effective containment step.
Isolating the endpoint at the network layer via EDR restricts network access (stopping command-and-control communication and lateral movement) while preserving the agent connection so analysts can continue investigating and gathering memory forensics.
Step-by-Step Solution
Key Concept
Endpoint Detection and Response (EDR) Host Isolation