Remediating Reported and Unresolved Threats

Cosmic

In my Threat Xplorer there are unresolved threats and there are reported threats, and I was wondering how I can remediate them.

Andrei_S Enterprise

Hello @Cosmic ,

Usually unresolved threats are archives or files that we could not delete and require a manual intervention. You can to manually review them and resolve. For the other type of threats you have predefined actions that you can take such as:

• Scan: configure and start a scan task for the endpoint.
• Isolate: use this action to isolate the endpoint from the rest of the network until the threat is resolved.
• Add exclusion: create an exclusion for the detected item. This action is available for files and processes.
• Add to Blocklist: add the detected item to Blocklist. This action is available only if the item hash is present.
• Show detections: view all the security events on the endpoint within the last 24 hours.
• Show in network: view the endpoint within the Network Inventory.

For more details you can check our KB article on analyzing detection events: https://www.bitdefender.com/business/support/en/77209-104369-analyzing-detection-events.html#UUID-83a63d33-fd37-c72a-5398-54b0e1bdf6a1

If you have a threat that you are unsure of what to do (how to resolve it) you can reach out to our enterprise support team for guidance: https://www.bitdefender.com/en-us/support/contact-us?last_page=BusinessCategory

Kind Regards,

Andrei