Response actions - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

After or during the investigation of malicious activity in your network, Cortex XSIAM offers various response actions that enable you to investigate the endpoint and take immediate action to remediate it. For example, when you detect a compromised endpoint, you can isolate it from your network to prevent it from communicating with any other internal or external device and thereby reducing an attacker’s mobility on your network. The available response actions are:

For response actions that rely on the Cortex XDR agent, the following table describes the supported platforms and minimal agent version. A dash (—) indicates the setting is not supported.