During a security event, an Endpoint Detection and Response (EDR) agent deployed on a critical file server detects suspicious rapid file modification patterns consistent with ransomware activity. Arrange the following EDR incident containment and response steps in the correct sequential order from first to last.
- 1Ingest and triage the initial EDR behavioral alert identifying suspicious process activity and rapid file modifications.
- 2Initiate network isolation of the affected host through the EDR agent console to stop command-and-control communication and lateral spread.
- 3Capture volatile process memory for forensic analysis and terminate the malicious parent and child process trees.
- 4Quarantine identified malicious artifacts and execute EDR file remediation and rollback controls.
- 5Perform a comprehensive telemetry scan to verify system integrity and restore normal network connectivity.
Cevap
The correct response sequence begins with ingesting and triaging the initial EDR alert, followed immediately by initiating agent-based network isolation to prevent lateral movement. Next, volatile memory is captured and active malicious processes are killed. Following host containment, malicious files are quarantined and modified files are remediated. Finally, a complete system integrity scan is completed before restoring network connectivity.
The standard EDR containment workflow prioritizes rapid threat isolation to prevent lateral movement, followed by volatile evidence preservation, malicious process termination, file quarantine/remediation, and finally health verification prior to restoring network access.
Adım Adım Çözüm
Anahtar Kavram
Endpoint Detection and Response (EDR) Incident Containment Workflow