When we get a high-confidence alert on an endpoint, the response often involves isolating the host in our EDR. Right now that’s manual, and there’s always some delay. I’m wondering how feasible it is to automate containment actions through Tines, and what safeguards people typically put in place to avoid isolating the wrong machine.
This kind of workflow is something we see all the time in Tines! No matter which EDR you use you can automate containment when integrated with the Tines platform. This kind of action however, is potentially sensitive and we usually recommend a review step for actions like this. In Tines, human-in-the-loop is part of our DNA (Cases, Collections, Pages, Workbench, Apps) and allows for a review stage where, once your workflow has triggered, an analyst or member of the team can ensure that this is the correct action to take prior to the continuation of your workflow insuring an intelligent workflow strategy, not just automated steps.