Team: Huntress EDR
Product: Manual Incident Remediation
Environment: Huntress EDR
Summary: Just as important as assisted remediations, sometimes manual fixes are required for active incidents in order to carry out necessary clean up tasks. Make sure to read through an entire incident report to know it has been handled properly.
Task:
In lieu of or in addition to Assisted Remediations, Huntress may also recommend Manual Remediations. Completing each Manual Remediations is optional, but Huntress does require acknowledgement of your understanding in order to resolve the report.
Prerequisites:
- Incident Report with no Assisted Remediation option
- Active incident with manual remediation recommended actions
- Ability to take all actions outlined in the Incident Report
Table of contents
View Incident
From your Huntress dashboard, click on Active Incidents
Find the incident and click on the Subject or Remediations checkbox
Read the report carefully to understand each step that must be taken to remediate the incident
Take Action
Note: Remediation Plans can include the following combinations of remediations
- Assisted & Manual Remediations
- Only Assisted Remediations
- Only Manual Remediations
- No Remediations
This article will focus on incidents with Only Manual and No Remediations. If Assisted Remediations are present, the option to manually resolve will not be available.
To review the remediation plan click Review Remediation Plan
Click Approve to acknowledge the manual remediation actions.
The Manual Remediations can also be viewed in the Remediations tab. Technicians can mark each remediation as complete as they finish them, however this is not required to resolve the incident report.
Huntress strongly recommends partners complete each manual remediation before resolving incidents.
Resolve Incident
After approving a manual remediation plan the option to Resolve the report will be enabled.
Select Confirm
Upon returning to the Dashboard, the incident will no longer appear as Active.