An enterprise Endpoint Detection and Response (EDR) system alerts a security analyst to an active malicious code injection on a user workstation. Sequence the standard EDR response steps from initial detection to host restoration.
- 1The EDR agent flags suspicious process behavior and triggers a high-severity incident alert.
- 2The security analyst initiates network isolation on the affected endpoint through the EDR console.
- 3The analyst terminates the malicious process tree and retrieves volatile memory telemetry for analysis.
- 4The endpoint is remediated, verified clean, and reconnected to the enterprise network.
Answer
The correct sequence starts with initial behavioral detection and alerting, followed by immediate endpoint network isolation, process termination and forensic telemetry collection, and concludes with host restoration.
The proper incident response workflow following an EDR alert begins with detection, moves immediately to containment (host network isolation), proceeds to eradication and evidence capture (terminating processes and dumping memory), and finishes with recovery (restoring endpoint network access).
Step-by-Step Solution
Key Concept
EDR Incident Containment and Response Sequence