You can obtain action remediation suggestions from Cortex XDR about malicious causality chains that have been detected.
Notice
This functionality requires a Cortex XDR Pro license.
When investigating suspicious incidents and causality chains you often need to restore and revert changes made to your endpoints as result of a malicious activity. To avoid manually searching for the affected files and registry keys on your endpoints, you can request Cortex XDR for remediation suggestions.
Cortex XDR investigates suspicious causality process chains and incidents on your endpoints and displays a list of suggested actions to remediate processes, files, and registry keys on your endpoint.
Danger
To initiate remediation suggestions, you must meet the following requirements:
Cortex XDR Pro per Endpoint license.
An App Administrator, Privileged Responder, or Privileged Security Admin role permissions which include the remediation permissions.
EDR data collection enabled.
Agent version 7.2 and above on Windows endpoints.
Initiate a remediation analysis.
You can initiate a remediation suggestions analysis from either of the following places:
In the Incidents view, click the more options icon and select Remediation Suggestions.
Note
Endpoints that are part of the incident view and do not meet the required criteria are excluded from the remediation analysis.
In the Causality View, either:
Right-click any process node involved in the causality chain and select Remediation Suggestion.
Select → .
Analysis can take a few minutes. You can minimize the analysis pop-up if desired while navigating to other pages.
Review the remediation suggestion summary and details.
Select one or more Original Event Descriptions and right-click to Remediate.
Track your remediation process.
Go to → → .
In the Action Type field, locate your remediation process.
Right-click Additional data to open the Detailed Results window.