What is Active Remediation?

Active Remediation is an annual subscription product that can be purchased as an add-on for Red Canary Managed Detection & Response (MDR) for Endpoint subscriptions. Active Remediation provides hands-on-keyboard remediation support for Red Canary-managed endpoints.
When Red Canary confirms and publishes a medium or high-severity threat occurring on a Red Canary-managed endpoint, Active Remediation’s Threat Response Engineers (TRE) perform remediation tasks utilizing a combination of Security Orchestration, Automation, & Response (SOAR) technology as well as Endpoint Detection & Response (EDR) provided remote response capabilities.

What is Active Remediation After Hours?

Active Remediation After Hours is an annual subscription product that can be purchased as an add-on for annual Red Canary MDR for Endpoint subscriptions. Active Remediation After Hours provides hands-on-keyboard remediation support on Red Canary managed endpoints, but only between 5pm-7am, seven days a week, in the user’s selected time zone.
When Red Canary confirms and publishes a malicious threat occurring on a Red Canary-managed endpoint during the coverage hours selected by the user, Active Remediation TRE’s perform remediation tasks utilizing a combination of SOAR technology as well as EDR-provided remote response capabilities.

Active Remediation After Hours only supports Malicious Software Threats. The TRE team will only respond to Threats that occur on Red Canary-managed endpoints during “after-hours” period specified by the user at the time of purchase.

Active Remediation performs remediation on Red Canary-managed endpoints for supported EDRs using endpoint tagging groups based on the subscription details outlined above. Please see Active Remediation: Administration for more information on how Active Remediation is set up.
When Red Canary MDR publishes a Threat occurring on a Red Canary managed endpoint tagged within a designated remediation group, the Active Remediation TRE team is notified to begin working through remediation based on the subscription details outlined above (example: threat classification and time zones if applicable).
Simultaneously, SOAR capabilities will take immediate actions to ensure the endpoint is in a standard state, including commands to isolate the host and removing artifacts known as identified indicators of compromise (IOCs).
Upon completing remediation tasks, a Remediation Summary is started that includes the Threat details and a log of all actions taken on the endpoint through the TRE team. These details are shared directly on the Threat timeline.
If the Threat cannot be fully remediated through the EDR remote response capabilities, then the following will occur:
- The Threat Response Engineers’ actions will be included in the Remediation Summary, along with additional recommended actions.
- The Threat will be left open for review and closed appropriately after the recommendations are considered and/or complete.

Active Remediation will be performed 24/7 with a combination of SOAR and EDR-provided remote response capabilities. Threats are prioritized based on severity and are acted on accordingly.
- High severity Threats are contained with automation and are then reviewed, with additional actions taken as necessary by the TRE team.
- Medium-severity Threats are contained with automation during non-business hours and are then reviewed. Additional actions are taken as necessary during business hours by the TRE team.
Active Remediation After Hours will be performed on Malicious Software Threats between 5pm-7am, seven days a week, in the user’s selected time zone using a combination of SOAR and EDR-provided remote response capabilities.

Red Canary Active Remediation has no publicly shareable Service Level Agreements (SLAs) or Objectives (SLOs) due to threat severity and complexity differences. This approach enables Red Canary Active Remediation to deliver high-quality services at scale continuously.

Windows
MacOS
- Note: Microsoft Defender for Endpoint for MacOS is still in Public Preview and will be supported by Active Remediation upon full release from Microsoft.

Linux is not supported by Active Remediation due to the following:
- Wide variety of of Linux distributions
- Response complexity and impact of 24/7 hands-on remediation without in-depth knowledge of the environment
- Operational importance of most Linux endpoints

All Red Canary portals include a “Request Remediation” button that is only unlocked for full Active Remediation users. Users with “Active Remediation After Hours” are not entitled to this feature.
The Request Remediation button allows for on-demand requests for remediation on a published High or Medium severity Threat. The purpose of this feature is to provide users with a mechanism for requesting additional support in instances where:
- Endpoints were previously not tagged within a designated remediation group but now are, and the user would like support addressing the threat
- Threats were acknowledged by the user, who then prompted remediation efforts for a variety of reasons, but now would like to reengage a TRE for support

The Active Remediation team will begin remediation efforts on the affected endpoint, adhering to the standard remediation practices outlined earlier in this document.

If you would like the TRE team to respond to all threats during your engagement as if they are true threats, you do not need to notify us. Red Canary will treat these threats as legitimate threats and take the necessary remediation actions.
If you would like the TRE team to be aware of the engagement and respond differently to threats that are associated with the engagement, click Contact Us before the engagement begins and we can work with you to customize our response.