Create Bulk Actions

The Threat Actions page enables you to filter threats by type and then take action on multiple threats simultaneously.

1. From the navigation menu, click Threats, then click Bulk Actions.

   

2. Select values for the following fields (all fields are required):

   • With state—The state of the threat. The state of the threat is set by your detection engineers and threat hunters.

   • And severity—Red Canary sets the severity.

   • And classification—Red Canary sets the classification.

3. Click Load matching threats. A list of the threats that match the criteria that you entered and which will be acted upon appears. If no threats appear, that means that there are no threats that match the criteria that you selected.

4. Scroll down to the bottom of the window.

5. Beneath Take Action, select the Action that you want to take on all of the listed threats.

6. Enter a comment so that you or a teammate can easily understand what you chose to do should you need to audit past actions.

7. Choose a Reason.

8. Click Execute bulk action.

Note: To start over, re-select Bulk Actions from the navigation menu.