Host Isolation - Sequence of Events

Host Isolation Scenario

Host isolation will take effect after a Huntress ThreatOps Analyst sends the incident report for the infected host.

Malicious Ransomware is spreading through a Partners network

What actions does Huntress take?

1An Incident Report is automatically opened due to a tripped ransomware canary or some other critical event.

2The report is immediately reviewed by a human threat hunter to ensure it is not a false positive.

3The report is sent ASAP and the host is isolated on send.