An Endpoint Detection and Response (EDR) agent detects an active ransomware process attempting to encrypt files on a enterprise workstation. Place the following incident response workflow steps in the correct chronological order from first action to last action.
- 1The EDR agent automatically isolates the infected workstation network interface from the local network.
- 2The automated EDR playbook terminates the malicious parent process and associated child process threads.
- 3The SOC analyst initiates remote memory dump collection and process tree analysis of the isolated host.
- 4The analyst issues an automated remediation command to remove persistent registry keys and restore quarantined files.
Cevap
The correct order of steps in the EDR incident response workflow is: 1) Isolate the host from the network, 2) Terminate the malicious process tree, 3) Perform memory analysis and process tree inspection, 4) Execute remediation and remove persistence artifacts.
In standard EDR operational playbooks, the immediate priority upon detecting active malware is containment (host isolation), followed by terminating the active process execution, conducting forensic memory analysis, and finally executing remediation commands to remove persistence.
Adım Adım Çözüm
Anahtar Kavram
EDR Automated Containment and Incident Response Workflow