Respond to threats

Respond to threats to maintain the security of your endpoints. 

Estimated reading time: 2 minutes

Red Canary uses your responses to threats to improve the quality and timeliness of threat investigation. Your response also helps the Red Canary team keep track of which threats pose a serious risk to your environment.

1. In Red Canary, click Threats.
2. Select the threat you want to respond to.
3. Review the threat timeline.
4. If the threat has been removed from your environment and is no longer a security concern, click Remediated.

   Note: If Red Canary detects similar malicious activity in the future, a new threat will be created for you to review.

5. To mark a threat as unremediated, click Unremediated, and then select one of the following options:
   1. This is unauthorized activity that will not be remediated. You accept the risk this software or behavior poses to your environment. If similar activity is observed in the future, it will be appended to this threat.
   2. This is authorized, non-testing activity. This activity is acceptable for some or all of your users. You can select the user group authorized to perform these activities in the future, which won’t be appended to this threat moving forward. You can also choose to not see detections like this in the future.
   3. This activity was incorrectly identified. This activity is a false positive. Red Canary will review this threat to improve future detections. Similar activity won’t be appended to this confirmed threat. You can add additional information to the text box.
   4. This was testing. Similar activity won’t be appended to this threat. Use the dropdowns to specify whether the testing was internal or external and the tool used for testing.

      Note: If you configured your Red Canary profile to exclude tests from reports, you won't see this activity in the Report Library.

       

6. Optionally, select I want to discuss this with my Incident Handler to talk to a Red Canary incident handler about this unremediated threat.
7. Click Mark as will not remediate.