Security Operations
Remediation Actions
🔎
❓

Remediation

Every action records actor, timestamp, device, incident, approval, API, before/after state and rollback information.
ActionTypeStatusModeActorDeviceIncidentMITRERiskApprovalCreated
ACT-E8270FBC50 Isolate Device Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28645 2026-10-21 03:52
ACT-8EC0CF6720 Block Indicator Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28644 2026-10-21 03:52
ACT-7D06C0BBFB Collect Investigation Package Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28643 2026-10-21 03:52
ACT-17AA6C1EF2 Notify Soc Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28642 2026-10-21 03:52
ACT-3DB0B84533 Update Incident Succeeded automatic worker corp-wks-1187 - T1003.001 56 - 2026-10-21 03:51
ACT-25B7E71FE4 Notify Teams Succeeded automatic worker corp-wks-1187 - T1003.001 56 - 2026-10-21 03:51
ACT-FD51DC15B7 Block Indicator Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28641 2026-10-21 03:46
ACT-1F3BD16EE3 Notify Soc Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28640 2026-10-21 03:46
ACT-470723EA4B Run Hunting Queries Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28639 2026-10-21 03:46
ACT-7BEE05589D Collect Investigation Package Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28638 2026-10-21 03:46
ACT-3ED7A7B960 Investigate Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28637 2026-10-21 03:46
ACT-28CB451D78 Create Remediation Task Awaiting Approval approval required worker - - - 59 28636 2026-10-21 03:18
ACT-BB60EC538F Notify Soc Awaiting Approval approval required worker - - - 59 28635 2026-10-21 03:18
ACT-2EC26BCCF6 Create Ticket Awaiting Approval approval required worker - - - 59 28634 2026-10-21 03:18
ACT-48C11D2F0B Create Remediation Task Awaiting Approval approval required worker - - - 58 28633 2026-10-21 03:17
ACT-2F4EB82B88 Notify Soc Awaiting Approval approval required worker - - - 58 28632 2026-10-21 03:17
ACT-6CAD63F0F4 Create Ticket Awaiting Approval approval required worker - - - 58 28631 2026-10-21 03:17
ACT-FA04B85EAB Create Remediation Task Awaiting Approval approval required worker - - - 58 28630 2026-10-21 03:11
ACT-A7B4D04785 Notify Soc Awaiting Approval approval required worker - - - 58 28629 2026-10-21 03:11
ACT-BE14BF94DF Create Ticket Awaiting Approval approval required worker - - - 58 28628 2026-10-21 03:11
ACT-83ECBE7370 Create Remediation Task Awaiting Approval approval required worker - - - 59 28627 2026-10-21 03:07
ACT-AA501E9E7D Notify Soc Awaiting Approval approval required worker - - - 59 28626 2026-10-21 03:07
ACT-9A7ACFD6D4 Create Ticket Awaiting Approval approval required worker - - - 59 28625 2026-10-21 03:07
ACT-7F70C067AB Update Incident Succeeded automatic worker corp-srv-app02 - T1021.002 55 - 2026-10-21 03:03
ACT-3B2C64C02A Notify Teams Succeeded automatic worker corp-srv-app02 - T1021.002 55 - 2026-10-21 03:03
ACT-2FD25D6045 Isolate Device Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28624 2026-10-21 02:52
ACT-A9FC066A59 Block Indicator Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28623 2026-10-21 02:52
ACT-271D318818 Collect Investigation Package Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28622 2026-10-21 02:52
ACT-BF67767BC4 Notify Soc Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28621 2026-10-21 02:52
ACT-725547E110 Update Incident Succeeded automatic worker corp-wks-1187 - T1003.001 56 - 2026-10-21 02:50
ACT-F6B0C0EAAF Notify Teams Succeeded automatic worker corp-wks-1187 - T1003.001 56 - 2026-10-21 02:50
ACT-51269E1D02 Block Indicator Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28620 2026-10-21 02:45
ACT-1B0689B12C Notify Soc Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28619 2026-10-21 02:45
ACT-6BC5B652E8 Run Hunting Queries Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28618 2026-10-21 02:45
ACT-F56F556C67 Collect Investigation Package Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28617 2026-10-21 02:45
ACT-78C765BEEE Investigate Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28616 2026-10-21 02:45
ACT-D645275755 Create Remediation Task Awaiting Approval approval required worker - - - 59 28615 2026-10-21 02:17
ACT-767D7EA89F Notify Soc Awaiting Approval approval required worker - - - 59 28614 2026-10-21 02:17
ACT-90A1A3B4CB Create Ticket Awaiting Approval approval required worker - - - 59 28613 2026-10-21 02:17
ACT-4E6EB7946D Create Remediation Task Awaiting Approval approval required worker - - - 58 28612 2026-10-21 02:16
ACT-F38D77528E Notify Soc Awaiting Approval approval required worker - - - 58 28611 2026-10-21 02:16
ACT-24DD5D45AE Create Ticket Awaiting Approval approval required worker - - - 58 28610 2026-10-21 02:16
ACT-A5728F34B2 Create Remediation Task Awaiting Approval approval required worker - - - 58 28609 2026-10-21 02:10
ACT-45CCC3D355 Notify Soc Awaiting Approval approval required worker - - - 58 28608 2026-10-21 02:10
ACT-86F574ACD0 Create Ticket Awaiting Approval approval required worker - - - 58 28607 2026-10-21 02:10
ACT-C762D09F7F Create Remediation Task Awaiting Approval approval required worker - - - 59 28606 2026-10-21 02:06
ACT-60CD70D61A Notify Soc Awaiting Approval approval required worker - - - 59 28605 2026-10-21 02:06
ACT-957264EBC6 Create Ticket Awaiting Approval approval required worker - - - 59 28604 2026-10-21 02:06
ACT-0101F5AB11 Update Incident Succeeded automatic worker corp-srv-app02 - T1021.002 55 - 2026-10-21 02:02
ACT-12DDC2C1B3 Notify Teams Succeeded automatic worker corp-srv-app02 - T1021.002 55 - 2026-10-21 02:02
ACT-07504E6C6F Isolate Device Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28603 2026-10-21 01:51
ACT-BA63AC96C2 Block Indicator Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28602 2026-10-21 01:51
ACT-830671FEB6 Collect Investigation Package Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28601 2026-10-21 01:51
ACT-C2FF5995BA Notify Soc Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28600 2026-10-21 01:51
ACT-E8D63B4DA6 Update Incident Succeeded automatic worker corp-wks-1187 - T1003.001 56 - 2026-10-21 01:50
ACT-AA20CFBC1D Notify Teams Succeeded automatic worker corp-wks-1187 - T1003.001 56 - 2026-10-21 01:50
ACT-08F885C128 Block Indicator Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28599 2026-10-21 01:44
ACT-9F8262A9F5 Notify Soc Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28598 2026-10-21 01:44
ACT-23BDAE6FD6 Run Hunting Queries Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28597 2026-10-21 01:44
ACT-F20B3FA0F1 Collect Investigation Package Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28596 2026-10-21 01:44
ACT-C71DCA0C49 Investigate Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28595 2026-10-21 01:44
ACT-EC03CC712D Create Remediation Task Awaiting Approval approval required worker - - - 59 28594 2026-10-21 01:16
ACT-331230A1DD Notify Soc Awaiting Approval approval required worker - - - 59 28593 2026-10-21 01:16
ACT-0FFC72FD9A Create Ticket Awaiting Approval approval required worker - - - 59 28592 2026-10-21 01:16
ACT-D146B4C99C Create Remediation Task Awaiting Approval approval required worker - - - 58 28591 2026-10-21 01:15
ACT-78C4A7F9D8 Notify Soc Awaiting Approval approval required worker - - - 58 28590 2026-10-21 01:15
ACT-62791E9FF0 Create Ticket Awaiting Approval approval required worker - - - 58 28589 2026-10-21 01:15
ACT-FF79F26E9C Create Remediation Task Awaiting Approval approval required worker - - - 58 28588 2026-10-21 01:10
ACT-ADCE9AB755 Notify Soc Awaiting Approval approval required worker - - - 58 28587 2026-10-21 01:10
ACT-79FC3013F9 Create Ticket Awaiting Approval approval required worker - - - 58 28586 2026-10-21 01:10
ACT-0A23D19F4E Create Remediation Task Awaiting Approval approval required worker - - - 59 28585 2026-10-21 01:05
ACT-721FF55C43 Notify Soc Awaiting Approval approval required worker - - - 59 28584 2026-10-21 01:05
ACT-0C14FBAA4D Create Ticket Awaiting Approval approval required worker - - - 59 28583 2026-10-21 01:05
ACT-89B3708C4F Update Incident Succeeded automatic worker corp-srv-app02 - T1021.002 55 - 2026-10-21 01:01
ACT-60B0179B3D Notify Teams Succeeded automatic worker corp-srv-app02 - T1021.002 55 - 2026-10-21 01:01
ACT-67D3787DD1 Isolate Device Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28582 2026-10-21 00:50
ACT-6942B3859A Block Indicator Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28581 2026-10-21 00:50
ACT-60F68430FA Collect Investigation Package Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28580 2026-10-21 00:50
ACT-3C85AE4241 Notify Soc Awaiting Approval approval required worker corp-srv-file01 - T1486 54 28579 2026-10-21 00:50
ACT-95EF52D828 Update Incident Succeeded automatic worker corp-wks-1187 - T1003.001 56 - 2026-10-21 00:49
ACT-268BB83E7A Notify Teams Succeeded automatic worker corp-wks-1187 - T1003.001 56 - 2026-10-21 00:49
ACT-A2AB1A4785 Block Indicator Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28578 2026-10-21 00:44
ACT-F3EFD17339 Notify Soc Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28577 2026-10-21 00:44
ACT-4EB49B7DE4 Run Hunting Queries Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28576 2026-10-21 00:44
ACT-77F1102025 Collect Investigation Package Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28575 2026-10-21 00:44
ACT-51112F0EFB Investigate Awaiting Approval approval required worker corp-wks-1187 - T1003.001 56 28574 2026-10-21 00:44
ACT-5D0EA6C7FE Create Remediation Task Awaiting Approval approval required worker - - - 59 28573 2026-10-21 00:16
ACT-2D39BD6830 Notify Soc Awaiting Approval approval required worker - - - 59 28572 2026-10-21 00:16
ACT-28FFC8B039 Create Ticket Awaiting Approval approval required worker - - - 59 28571 2026-10-21 00:16
ACT-70A4895DDB Create Remediation Task Awaiting Approval approval required worker - - - 58 28570 2026-10-21 00:15
ACT-9132F369EB Notify Soc Awaiting Approval approval required worker - - - 58 28569 2026-10-21 00:15
ACT-40C02EDDE0 Create Ticket Awaiting Approval approval required worker - - - 58 28568 2026-10-21 00:15
ACT-45CAFBB743 Create Remediation Task Awaiting Approval approval required worker - - - 58 28567 2026-10-21 00:09
ACT-0D3ED19977 Notify Soc Awaiting Approval approval required worker - - - 58 28566 2026-10-21 00:09
ACT-79C5684874 Create Ticket Awaiting Approval approval required worker - - - 58 28565 2026-10-21 00:09
ACT-13CFEB5868 Create Remediation Task Awaiting Approval approval required worker - - - 59 28564 2026-10-21 00:05
ACT-A406EE18BE Notify Soc Awaiting Approval approval required worker - - - 59 28563 2026-10-21 00:05
ACT-688F9E4E8F Create Ticket Awaiting Approval approval required worker - - - 59 28562 2026-10-21 00:05
ACT-10993738B7 Update Incident Succeeded automatic worker corp-srv-app02 - T1021.002 55 - 2026-10-21 00:01
ACT-779F403E74 Notify Teams Succeeded automatic worker corp-srv-app02 - T1021.002 55 - 2026-10-21 00:01
⚡ Auto Remediation

Pick a remediation action and a target device. Destructive actions always require approval first. Registry-related fixes are never applied automatically - you will be warned and the request is escalated to an Administrator.

Safety modes
DisabledAction never executes
RecommendDry run only - shows what WOULD happen
Approval RequiredHuman approval before execution
AutomaticExecutes immediately (never for destructive actions)
Emergency AutomaticImmediate execution, opt-in per action