During an active security incident on an enterprise application server, logs indicate an unauthorized process attempting to extract LSASS memory contents. The incident response team must immediately stop potential lateral movement across the internal domain while keeping an active channel open to capture volatile RAM and run diagnostic commands. Which capability of an Endpoint Detection and Response (EDR) platform best meets these requirements?
- Initiating agent-based network host isolation to restrict endpoint traffic while maintaining security console communicationsAnswer
- BUpdating perimeter firewall access control lists to block incoming connections to the server's public IP address
- CIssuing a remote power cycle command to reboot the server and wipe the malicious process space
- DDeploying an updated signature definition file to legacy antivirus software to quarantine the payload
Answer
Initiating agent-based network host isolation to restrict endpoint traffic while maintaining security console communications
Agent-based host network isolation enforced by an EDR platform blocks non-essential inbound and outbound host traffic at the endpoint network layer. This stops an attacker from moving laterally across the domain, while preserving the secure control channel between the EDR agent and the central management server so security teams can capture volatile RAM and execute remediation commands.
Step-by-Step Solution
Key Concept
EDR Host Isolation and Behavioral Containment