During the analysis of a security incident, an endpoint is flagged with several alerts, including unusual process executions and network connections to suspicious external IP addresses. Which of the following responses leverages the full potential of the EDR solution and is the MOST immediate and effective in containing the threat?
Isolating the endpoint from the network to prevent further potential data loss or lateral movement.
Escalating the alerts to the organization's cyber incident response team for further investigation.
Performing a full memory dump of the endpoint for a detailed forensic analysis.
Initiating an on-demand threat hunt to gather more information about the executing processes and network connections.
|Incident Response and Management
|Reporting and Communication