Getting Started with Active Remediation

Red Canary Active Remediation is an annual subscription product that can be purchased as an add-on for Red Canary Managed Detection & Response (MDR) for Endpoint subscriptions.

Active Remediation provides hands-on-keyboard remediation support for Red Canary-managed endpoints.

How does Active Remediation Work?

Active Remediation utilizes endpoint sensor groups to perform remediation on Red Canary managed endpoints for supported EDRs based on the subscription details outlined above. Please see the EDR-specific sections below for more information on how Active Remediation is configured.

When Red Canary MDR publishes a Threat occurring on a Red Canary managed endpoint tagged within a designated remediation group:

• the Active Remediation Threat Response Engineer (TRE) team is notified to begin working through remediation based on the subscription details outlined above (example: threat classification and time zones if applicable).

• Simultaneously, SOAR (security orchestration, automation and response) capabilities will take immediate actions to ensure the endpoint is in a standard state, including commands to isolate the host and removing artifacts known as identified indicators of compromise (IOCs).

• Upon notification of the Threat, the team acknowledges it, indicating in your portal that a TRE has begun working on it.

• If a Threat is marked as remediated by your team while a TRE is actively investigating or remediating the Threat, we will conclude our investigation and response at that time.

Following our investigation and completion of remediation tasks:

• a Remediation Summary is documented that includes the Threat details and a log of all actions taken on the endpoint through the TRE team. These details are shared directly on the Threat timeline.

• If the Threat cannot be fully remediated through the EDR remote response capabilities, then the following will occur: 

  • The Threat Response Engineers’ actions will be included in the Remediation Summary, along with additional recommended actions.

  • The Threat will be left open for review and closed appropriately after the recommendations are considered and/or complete.

Configuring Active Remediation

Below is the process for tagging endpoints that will be covered by Red Canary Active Remediation within your Red Canary portal, related to each supported EDR.