Remediate an Incident

Remediation is the process of acknowledging an incident and restoring access.

The following example will demonstrate how to restore access to "John Doe" who was flagged for the investigation via a custom incident.

Example 1. Remediating a custom incident

  1. Navigate to the Incidents - Summary page.

  2. Click the button that corresponds to John’s incident in the View column .

  3. In the General pane, Click Restore Access.

  4. Select Unblock and block immediately if detected again.

  5. Check the box next to John’s email.

  6. Click Unblock.

  7. Finally, Click Close Incident, and again in the dialog.

Acknowledging incidents is not required prior to lifting any blocks. It is a way to let it be known that the issue has been seen and is being addressed.

Example 2. Remediating a natural incident with user/host blocks

  1. Navigate to the Incidents - Summary page.

  2. Click the button that corresponds to John’s incident in the View column.

  3. In the General pane, Click Acknowledge, and again in the dialog.

  4. Click Restore Access.

  5. Select Unblock and block immediately if detected again.

  6. Check the box next to John’s email.

  7. Click Unblock.

  8. Finally, Click Close Incident, and again in the dialog.

When remediating an incident, they won’t always come with user/host blocks applied as demonstrated in the prior example. If an incident is below 7.5 on the severity scale, no blocks will be applied due to the default rules and the Restore Access steps can be skipped.