A Security Operations Center (SOC) team is configuring an automated Endpoint Detection and Response (EDR) incident response workflow to handle host-based malicious script execution. In what sequence should the EDR platform execute the containment, mitigation, and post-incident investigation actions?
- 1Detect malicious behavioral patterns and trigger the automated response playbook.
- 2Isolate the host network interfaces while maintaining connection to the EDR management console.
- 3Terminate active malicious process trees and quarantine associated binary artifacts on the host.
- 4Capture volatile RAM evidence and process lineage logs for root-cause analysis.
- 5Deploy updated Indicators of Compromise (IOCs) across all managed enterprise endpoints.
Answer
The correct operational sequence begins with initial detection, followed by host network isolation, active process termination and file quarantine, volatile forensic artifact collection, and finally deploying updated IOCs across the enterprise.
Effective EDR incident response relies on a structured sequence: detecting anomalous behavior triggers automated playbooks, network isolation prevents lateral movement while preserving volatile state, process termination and quarantine neutralize host impact, forensic data capture enables root-cause investigation, and enterprise-wide IOC deployment prevents repeat attacks.
Step-by-Step Solution
Key Concept
EDR Incident Containment and Remediation Workflow