Problem Statement

Today, SOC response capabilities on the endpoint are limited. While malicious files can be quarantined or IP addresses blocked, high-severity incidents often require isolating hosts from the network entirely. SOC teams face a dilemma: enforce less disruptive controls and risk allowing an attacker to continue, or enforce hard controls like host isolation and disrupt the end user.

Solution

Adaptive Risk Reduction enables security teams to take immediate and measured actions on endpoints during active threat events, without fully isolating the device or disrupting business operations.

• Console Integration: SOC analysts can trigger predefined responses directly from their EDR/XDR console.
• EPM Enforcement: These responses enforce endpoint restrictions through EPM, reducing risk while investigations continue.
• Automated Policy: Delivered via a plugin-based integration, allowing automated enforcement on specific endpoints based on threat events raised in the EDR system.

Benefits

• Block attackers without disrupting the business: Maintain productivity while mitigating threats.
• Enforce controls from within your SOAR solution: Streamline your security operations workflow.
• Execute granular response actions: Validate malicious activities with precision before taking the step of blocking a user.