Security Advanced SECURITY-070 · 22 min

EDR quarantine removes the log shipper binary and host visibility disappears without an alert

The endpoint agent did its job from one perspective, but security operations lose telemetry because the quarantined component was also the only path to central visibility.

Incident ResponsePro

시나리오

The endpoint agent did its job from one perspective, but security operations lose …

구독하면 이어서 볼 수 있어요

이 문제의 전체 시나리오와 점검 체크리스트, 복구 순서, 모범 풀이는 Pro 구독에서 열립니다.

구독 안내 보기

다음으로 이어서 보기 좋은 문제

내 풀이

저장됨

1 · 원인 분석 2 · 복구 방안 3 · 재발 방지

풀이 기록·힌트·북마크는 로그인하면 계정에 저장되어 웹·앱에서 이어집니다.

EDR quarantine removes the log shipper binary and host visibility disappears without an alert

EDR quarantine removes the log shipper binary and blinds central visibility

An incident isolation rule cuts a host off from attackers and also from the EDR telemetry path, leaving responders blind

An incident quarantine revokes general egress while forensic collection still depends on one artifact upload endpoint during a failover rehearsal

SIEM parser update collapses two source IP fields and the threat hunt queries miss half the traffic