Response actions

Disable User Account

Signs the user out of all active application and browser sessions of the user account. It may take a few minutes for the process to complete. Users are prevented from signing in any new session.

For more information, see Disable User Account task.

Enable User Account

Allows the user to sign in to new application and browser sessions. It may take a few minutes for the process to complete.

For more information, see Enable User Account task.

Force Password Reset

Signs the user out of all active application and browser sessions, and forces the user to create a new password during the next sign-in attempt. It may take a few minutes for the process to complete.

For more information, see Force Password Reset task.

Force Sign Out

Signs the user out of all active application and browser sessions of the user account. It may take a few minutes for the process to complete. Users are not prevented from immediately signing back in the closed sessions or signing in new sessions.

For more information, see Force Sign Out task.

Revoke Access Permission

Revokes the user’s access permission on the AWS Identity and Access Management (IAM) service. After revoking the permission, the user can no longer access any AWS resources. Allow a few minutes for this task to complete.

For more information, see Revoke Access Permission task.

Add to Block List

Adds supported objects such as File SHA-1, URL, IP address, or domain objects to the User-Defined Suspicious Objects List, which blocks the objects on subsequent detections

For more information, see Add to Block List task.

Collect File

Compresses the selected file detected by the network appliance in a password-protected archive and then sends the archive to the Response Management app

Collect Investigation Package

Compresses the selected investigation package that includes OpenIOC files describing Indicators of Compromise identified on the affected host or network in a password-protected archive and then sends the archive to the Response Management app

Collect Network Analysis Package

Compresses the selected network analysis package (including an investigation package, a PCAP file, and a selected file detected by the network appliance) in a password-protected archive and then sends the archive to the Response Management app

For more information, see Collect Network Analysis Package task.

Collect PCAP File

Compresses the selected Packet Capture file in a password-protected archive and then sends the archive to the Response Management app

Remove from Block List

Removes the File SHA-1, URL, IP address, or Domain object added to the User-Defined Suspicious Objects List through the Add to Block List response

For more information, see Remove from Block List task.

Submit for Sandbox Analysis

Submits the selected file objects for automated analysis in a sandbox, a secure virtual environment

For more information, see Submit for Sandbox Analysis task.

Add to Block List

Adds supported objects such as File SHA-1, URL, IP address, or domain objects to the User-Defined Suspicious Objects List, which blocks the objects on subsequent detections

For more information, see Add to Block List task.

Collect Evidence

Collects forensic evidence from the specified endpoints and uploads it to the Forensics app.

For more information, see Collect Evidence task.

Collect File

Compresses the selected file on the endpoint in a password-protected archive and then sends the archive to the Response Management app

For more information, see Collect File task.

Dump Process Memory

Directly accesses an endpoint and executes remote shell commands to identify currently running processes that may be causing suspicious activity during an investigation

Isolate Endpoint

Disconnects the target endpoint from the network, except for communication with the managing Trend Micro server product

For more information, see Isolate Endpoint task.

Remove from Block List

Removes the File SHA-1, URL, IP address, or Domain object added to the User-Defined Suspicious Objects List through the Add to Block List response

For more information, see Remove from Block List task.

Restore Connection

Restores network connectivity to an endpoint that already applied the Isolate Endpoint action

For more information, see Restore Connection task.

Run osquery

Executes SQL queries using osquery (version 5.7.0) to obtain system information of the specified endpoints.

For more information, see Run osquery task.

Run Remote Custom Script

Connects to a monitored endpoint and executes a previously uploaded PowerShell or Bash script file

For more information, see Run Remote Custom Script task.

Run YARA rules

Executes custom YARA rules (version 4.2.3) on the specified endpoints.

For more information, see Run YARA Rules task.

Start Remote Shell Session

Connects to a monitored endpoint and allows you to execute remote commands or a custom script file for investigation

For more information, see Start Remote Shell Session task.

Submit for Sandbox Analysis

Submits the selected file objects for automated analysis in a sandbox, a secure virtual environment

For more information, see Submit for Sandbox Analysis task.

Terminate Process

Terminates the active process and allows you to terminate the process on all affected endpoints

For more information, see Terminate Process task.

Scan for Malware

Performs a one-time scan on one or more endpoints for file-based threats such as viruses, spyware, and grayware. For more information, see Scan for Malware task.

• Trend Micro Apex One as a Service
• Standard Endpoint Protection

Add to Block List

Adds supported objects such as File SHA-1, URL, IP address, or domain objects to the User-Defined Suspicious Objects List, which blocks the objects on subsequent detections

For more information, see Add to Block List task.

Delete Message

Deletes the selected email message from the selected mailboxes

For more information, see Delete Message task.

Quarantine Message

Moves the selected email message to the quarantine folder and allows you to quarantine the message from all affected mailboxes

For more information, see Quarantine Message task.

Remove from Block List

Removes the File SHA-1, URL, IP address, or Domain object added to the User-Defined Suspicious Objects List through the Add to Block List response

For more information, see Remove from Block List task.

Isolate Container

Allows the user to limit the spread of suspicious processes within a container and investigate the causes by disconnecting the containing pod from relevant networks and preventing data transfer into and out of the pod. For more information, see Isolate Container task.

• Trend Vision One Container Security

Terminate Container

Stops suspicious behavior of containers within a pod by terminating the containing pod. For more information, see Terminate Container task.

• Trend Vision One Container Security

Resume Container

Resumes containers within a previously isolated pod. For more information, see Resume Container task.

• Trend Vision One Container Security