Incident Response
Overview
Section titled “Overview”Incident Response actions take containment measures on the execution’s target asset.
| Action | Description |
|---|---|
| Isolate Device | Isolates the asset from the network, or removes an existing isolation. |
Like the Collect Evidence actions, Incident Response actions:
- Always run on the asset from the trigger.
- Wait for the change to take effect on the asset before the next step starts.
- Cannot be tested from the editor.