An incident isolation rule cuts a host off from attackers and also from the...

시나리오

Containment succeeds, yet investigation quality collapses …

단서

구독하면 이어서 볼 수 있어요

이 문제의 전체 시나리오와 점검 체크리스트, 복구 순서, 모범 풀이는 Pro 구독에서 열립니다.

구독 안내 보기

먼저 볼 것

점검 체크리스트

복구와 재발 방지

같이 보면 좋은 질문

현장에서 본 비슷한 케이스

다음으로 이어서 보기 좋은 문제

Security Advanced

EDR quarantine removes the log shipper binary and host visibility disappears without an alert

The endpoint agent did its job from one perspective, but security operations lose telemetry because the quarantined component was also the only path to central visibility.

22 min

View problem

Security Advanced

A ransomware isolation workflow snapshots the volumes correctly, but the snapshot retention tag is missing and cleanup automation deletes the evidence before triage starts

A ransomware isolation workflow snapshots the volumes correctly, but the snapshot retention tag is missing and cleanup automation deletes the evidence before triage st...

18 min

View problem

Security Advanced

An incident quarantine revokes general egress while forensic collection still depends on one artifact upload endpoint during a failover rehearsal

Containment is immediate and visibility disappears with it. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.

18 min

View problem

Security Advanced

Containment revokes general egress while one evidence collection or telemetry upload endpoint was still needed for the investigation during a failover rehearsal

The isolation step works and responders lose the path that would have made the incident explainable. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.

19 min

View problem

An incident isolation rule cuts a host off from attackers and also from the EDR telemetry path, leaving responders blind

EDR quarantine removes the log shipper binary and host visibility disappears without an alert

A ransomware isolation workflow snapshots the volumes correctly, but the snapshot retention tag is missing and cleanup automation deletes the evidence before triage starts

An incident quarantine revokes general egress while forensic collection still depends on one artifact upload endpoint during a failover rehearsal

Containment revokes general egress while one evidence collection or telemetry upload endpoint was still needed for the investigation during a failover rehearsal