Respond to threats

When you need to contain a threat, you can request a response action on an affected device. Every response action must be approved by an authorised person before it runs. Every action is signed and recorded, so you can always see who requested it, who approved it and what happened.

• To request an action, you need the Endpoint Security analyst or Endpoint Security administrator role.
• To approve an action, you need to be set up as an approver in your organisation. You can’t approve an action you requested yourself.
• Tell the device’s user before you isolate it, if you can. An isolated device can’t reach email, websites or shared files.

1. Open the incident, or select Devices and open the affected device.

2. Select Response actions, then choose the action, for example Isolate device.

3. Enter a Reason. Approvers see this, so explain why the action is needed.

4. Select Request. The action shows the status Awaiting approval.

   endpoint.prismara.eu

   Screenshot folgtRequest response action panel for demo device CONTOSO-LT01 with Isolate device selected and a reason entered

The approvers for your organisation are notified that an action is waiting.

1. As an approver, select Response actions > Pending approval.

2. Open the request and check the device, the action and the reason.

3. Select Approve or Reject. If you reject the request, add a comment for the person who asked.

   endpoint.prismara.eu

   Screenshot folgtPending approval list with one demo Isolate device request for CONTOSO-LT01, showing the requester, reason, and Approve and Reject buttons

4. Follow the prompt to confirm your approval.

1. Select Response actions > History.

2. Find the action. Its status changes from Approved to Running and then Completed or Failed.

3. Select the action to see who requested it, who approved it, when it ran and the result. For Collect investigation package, select Download to get the package.

   endpoint.prismara.eu

   Screenshot folgtResponse action history showing a completed Isolate device action with requester, approver and timestamps

If the device is offline, the action runs the next time the device connects.

Releasing a device from isolation is also a response action, so it needs approval in the same way.

1. Open the device and select Response actions > Release from isolation.

2. Enter a reason, for example that the threat has been removed, and select Request.

3. After an approver approves the request, check that the device status changes from Isolated to Protected.

• Investigate incidents
• Troubleshoot Prismara Endpoint Security
• Prismara SOC overview