Remediation tools

To contain or eradicate threats, EDR detection engines can be configured in blocking mode or in detection, blocking, and quarantine mode. By configuring engines and detection rules, EDR can prevent a process from launching, kill it once launched, or quarantine files.

These different configurations ensure optimal protection based on your cybersecurity needs and context, and the maturity and stability of your detection rules.

When an alert is triggered, quickly isolate an endpoint, a group of endpoints, or an entire IT infrastructure – or directly remediate the threat to:

• Prevent attackers from moving laterally
• Stop control over the endpoints attackers have managed to take over
• Limit the spread of an attack

If an attack or security incident is detected, HarfangLab is your toolkit for responding accurately and effectively to threats using preconfigured remediation jobs or scripts and executables that can be customized via Remote Shell:

• Malicious file deletion or quarantine
• Services or scheduled task deletion
• Operations on registry databases
• Process kill

Launch remediation jobs across your entire IT infrastructure, or on a selection of targeted endpoints.