Responding to threats

Before we go through the response actions our Tier 2 analyst takes in our example scenario, let’s walk through the available response options from a different perspective than we have so far. If you recall back in Chapter 4, Understanding Endpoint Detection and Response, we covered what each response action does. In this section, we’re going to try to frame those same actions from a tactical response perspective.

Cold snack

With any response action, choose wisely. For instance, there may be an impact on users if you’re mistakenly blocking a legitimate file, or you could be alerting an attacker that they’ve been spotted, which can lead them to a potentially destructive exit from the environment in an attempt to prevent defenders from tracking them.

Files and processes

When you have encountered a file (or process) of interest, one of the first things you’ll likely do is check whether it’s present elsewhere in...