Prismara Endpoint SecurityHow-to guide
Respond to threats
When you need to contain a threat, you can request a response action on an affected device. Every response action must be approved by an authorised person before it runs. Every action is signed and recorded, so you can always see who requested it, who approved it and what happened.
Available response actions
Section titled “Available response actions”| Action | What it does |
|---|---|
| Isolate device | Cuts the device off from the network, except for its connection to Prismara Endpoint Security, so you can keep investigating. |
| Stop process | Ends a running process on the device. |
| Quarantine file | Moves a file to a protected location where it can’t run. You can restore it later. |
| Collect investigation package | Gathers diagnostic information from the device for you to download and review. |
Before you begin
Section titled “Before you begin”- To request an action, you need the Endpoint Security analyst or Endpoint Security administrator role.
- To approve an action, you need to be set up as an approver in your organisation. You can’t approve an action you requested yourself.
- Tell the device’s user before you isolate it, if you can. An isolated device can’t reach email, websites or shared files.
Request an action
Section titled “Request an action”-
Open the incident, or select Devices and open the affected device.
-
Select Response actions, then choose the action, for example Isolate device.
-
Enter a Reason. Approvers see this, so explain why the action is needed.
-
Select Request. The action shows the status Awaiting approval.
Screenshot pendingRequest response action panel for demo device CONTOSO-LT01 with Isolate device selected and a reason entered
Approve the action
Section titled “Approve the action”The approvers for your organisation are notified that an action is waiting.
-
As an approver, select Response actions > Pending approval.
-
Open the request and check the device, the action and the reason.
-
Select Approve or Reject. If you reject the request, add a comment for the person who asked.
Screenshot pendingPending approval list with one demo Isolate device request for CONTOSO-LT01, showing the requester, reason, and Approve and Reject buttons -
Follow the prompt to confirm your approval.
See the result
Section titled “See the result”-
Select Response actions > History.
-
Find the action. Its status changes from Approved to Running and then Completed or Failed.
-
Select the action to see who requested it, who approved it, when it ran and the result. For Collect investigation package, select Download to get the package.
Screenshot pendingResponse action history showing a completed Isolate device action with requester, approver and timestamps
If the device is offline, the action runs the next time the device connects.
Release a device from isolation
Section titled “Release a device from isolation”Releasing a device from isolation is also a response action, so it needs approval in the same way.
-
Open the device and select Response actions > Release from isolation.
-
Enter a reason, for example that the threat has been removed, and select Request.
-
After an approver approves the request, check that the device status changes from Isolated to Protected.