An enterprise Endpoint Detection and Response (EDR) agent detects an unauthorized process attempting to read sensitive memory structures from the Local Security Authority Subsystem Service (LSASS) on a finance system host. In what sequence should the automated EDR response workflow process this security event from initial containment to post-incident analysis?
- 1Detect the anomalous process behavior and trigger a high-severity alert based on behavioral heuristic rules.
- 2Initiate host-level network isolation through the EDR agent while maintaining the management control channel.
- 3Terminate the malicious process tree and quarantine associated temporary binary artifacts on the host.
- 4Gather forensic telemetry and sweep the enterprise endpoint fleet for matching Indicators of Compromise (IoCs).
Answer
The correct operational sequence begins with detecting anomalous process behavior, followed by isolating the host via the EDR agent, terminating malicious processes and quarantining artifacts, and concludes with gathering forensic telemetry for fleet-wide IoC threat hunting.
The workflow follows standard EDR incident response methodology: first detect the malicious behavioral attempt on the endpoint, isolate the host to restrict lateral movement, kill malicious processes and quarantine binary components, and finally gather forensic telemetry to hunt for Indicators of Compromise (IoCs) enterprise-wide.
Step-by-Step Solution
Key Concept
Endpoint Detection and Response (EDR) Automated Containment and Remediation Workflow