Remediate changes from malicious activity

Remediate changes caused by malicious activity.

When investigating cases and causality chains you might need to restore and revert changes made to your endpoints as result of a malicious activity. To avoid manually searching for the affected files and registry keys on your endpoints, you can request remediation suggestions.

Prerequisite

To initiate remediation suggestions, you must have the following system requirements:

• An App Administrator, Privileged Responder, or Privileged Security Admin role permissions which include the remediation permissions.
• EDR data collection enabled.
• Agent version 7.2 or above on Windows endpoints.

How to initiate remediation suggestions

1. You can initiate a remediation suggestions analysis from the following places:

   • In the Cases view, click the more options icon in the cases panel and select Remediation Suggestions.

     Note

     Endpoints that are part of the Case view and do not meet the required criteria are excluded from the remediation analysis.
   • In the Causality View:

     • Right-click any process node involved in the causality chain and select Remediation Suggestion.
     • Select Actions → Remediation Suggestions.

   Analysis can take a few minutes. You can minimize the analysis pop-up if desired while navigating to other pages.
2. Review the remediation suggestion summary and details.

Field descriptions

| <p>Field</p> | <p>Description</p> |
|----|----|
| <p>Original Event Description</p> | <p>Summary of the initial event that triggered the malicious causality chain.</p> |
| <p>Original Event Timestamp</p> | <p>Timestamp of the initial event that triggered the malicious causality chain.</p> |
| <p>Endpoint Name</p> | <p>Hostname of the endpoint.</p> |
| <p>IP Address</p> | <p>IP address associated with the endpoint.</p> |
| <p>Endpoint Status</p> | <p>Connectivity status of the endpoint.</p> |
| <p>Domain</p> | <p>Domain or workgroup to which the endpoint belongs, if applicable.</p> |
| <p>Endpoint ID</p> | <p>Unique ID assigned by Cortex Cloud that identifies the endpoint.</p> |
| <p>Suggested Remediation</p> | <p>Action suggested by the remediation scan for you to apply to the causality chain process:</p><ul><li>Delete File.</li><li>Restore File.</li><li>Rename File.</li><li>Delete Registry Value.</li><li>Restore Registry Value.</li><li><p>Terminate Process</p><p>Available when selecting **Remediation Suggestions** for a node in the Causality View.</p></li><li><p>Terminate Causality</p><p>Terminate the entire causality chain of processes that have been executed under the process tree of the listed Causality Group Owner (GCO) process name.</p></li><li><p>Manual Remediation</p><p>Requires you to take manual action to revert or restore.</p></li></ul> |
| <p>Suggested Remediation Description</p> | <p>Summary of the remediation suggestion to apply to the file or registry.</p> |
| <p>Remediation Status</p> | <p>Status of the applied remediation.</p> |
| <p>Remediation Date</p> | <p>Displays the timestamp of when all of the endpoint artifacts were remediated. If missing a successful remediation, the field will not display the timestamp.</p> |

</details>

1. Select one or more rows, right-click and select Remediate.
2. Track your remediation process.

   Go to Investigation & Response+Response → Action Center → All Actions and locate your remediation process in the Action Type field. Right-click Additional data to open the Detailed Results window.

1. Select one or more rows, right-click and select Remediate.
2. Track your remediation process.

   Go to Investigation & Response+Response → Action Center → All Actions and locate your remediation process in the Action Type field. Right-click Additional data to open the Detailed Results window.