Event search tool can be used to further search data that has already been sent to the EDR Backend related to the Broad Context Detection. Investigation phase can also be used in Threat Hunting which is not necessarily triggered by the Broad Context Detection.The investigation phase typically includes retrieving more data from the endpoints, such as logs, task lists, process lists, registry entries, files and folders, memory contents, and list of network connections. Retrieve Registry HivesThe incident investigation consists of many activities that can be performed to get more content to support incident investigation and incident response but also to collect forensics evidence about the attack.Remediating actions Investigative actions.This can be done per endpoint or organization-wide if necessary.Response capability can be divided into three parts: It also provides responders the ability to slow down or stop an attacker from achieving their objectives – for example, by degrading command and control communications – and/or rapidly contain threats as they are discovered and blocking them immediately. Unfortunately we cannot give a timeline for this at the moment.The importance of “R”The Response capability provides defenders with capability to enrich forensic artefacts from endpoints and to fight back against attackers. These powerful new response actions was first available for partners and customers in EMEA region, and is now available globally.We will be adding support for Mac and Linux at a later date. Reducing the time the attacker can operate in your infrastructure also reduces the damage the attacker can cause.When talking to our customers and partners it has become clear that there is a need to automate certain response actions, and a need to execute certain actions for multiple endpoints simultaneously to increase productivity.We are happy to announce several new response actions that can be remotely triggered for one or multiple endpoints at the same time.

A common issue encountered by incident response is the ability to rapidly respond to an incident and mitigate the risk once it has been identified. Take a look!We have added many new response actions to the Microsoft Windows version of the Elements Endpoint Detection and Response product.

Update : This functionality is now available in all regions.Note: Article updated to make it clear that these new actions are currently only available on Microsoft Windows.Update: A blog post has been made with more technical examples, together with associated videos. Tens of new response actions added to Elements EDR - F-Secure Community

Incident investigation mac log files