Manual Remediation for Active Incidents

Team: Huntress EDR
Product: Manual Incident Remediation
Environment: Huntress EDR
Summary: Just as important as assisted remediations, sometimes manual fixes are required for active incidents in order to carry out necessary clean up tasks. Make sure to read through an entire incident report to know it has been handled properly.

Task: 

In lieu of or in addition to Assisted Remediations, Huntress may also recommend Manual Remediations. Completing each Manual Remediations is optional, but Huntress does require acknowledgement of your understanding in order to resolve the report.

Prerequisites: 

• Incident Report with no Assisted Remediation option
• Active incident with manual remediation recommended actions
• Ability to take all actions outlined in the Incident Report

Table of contents

Find the incident and click on the Subject or Remediations checkbox

Read the report carefully to understand each step that must be taken to remediate the incident

Take Action

Note: Remediation Plans can include the following combinations of remediations

• Assisted & Manual Remediations
• Only Assisted Remediations
• Only Manual Remediations 
• No Remediations

This article will focus on incidents with Only Manual and No Remediations.  If Assisted Remediations are present, the option to manually resolve will not be available. 

To review the remediation plan click Review Remediation Plan 

Click Approve to acknowledge the manual remediation actions.

The Manual Remediations can also be viewed in the Remediations tab. Technicians can mark each remediation as complete as they finish them, however this is not required to resolve the incident report.

Huntress strongly recommends partners complete each manual remediation before resolving incidents.

Resolve Incident

After approving a manual remediation plan the option to Resolve the report will be enabled.

Select Confirm

Upon returning to the Dashboard, the incident will no longer appear as Active. 

Further reading: 

• Manual Remediation of User Registry Keys
• Assisted Remediation Overview
• Using Assisted Remediation