TABLE OF CONTENTS

• Overview
• Types of Remediation
• Benefits of Remediation
• Prerequisites
  • List of Supported Alert Types for Remediation
• Configuration Steps
  • Step 1: Login
  • Step 2:  Configure Remediator
  • Step 3: Test Connection
  • Step 4: Access Auto Remediation
  • Step 5: Configure Policy
  • Step 6: Verify Configuration
• How It Works (Execution Flow)
• Verification

Overview

Remediation in ADR refers to the process of taking corrective action against identified threats, either automatically or manually, using connected enforcement devices such as Firewalls, EDRs, NACs, and Identity Providers.

It is the final stage of the Detect → Analyze → Respond workflow, enabling organizations to contain, block, or neutralize malicious activity in real time.

The Auto Remediation in ADR allows the platform to automatically execute remediation actions in response to alerts, based on pre-defined policies. This ensures real-time containment of threats without requiring manual intervention, helping security teams reduce dwell time and minimize potential damage.

Types of Remediation

1. Manual Remediation– Security analysts manually trigger actions on alert from the ADR Dashboard.

    Example: The analyst reviewed the alert and initiated remediation, resulting in the endpoint being successfully isolated through the EDR solution.

2. Auto-Remediation– Policies or playbooks trigger actions without human intervention , if analyst configures auto-remediation.

    Example: An IP flagged as malicious is automatically blocked on the firewall.

    Selected alert types are automatically remediated based on configuration.

Benefits of Remediation

• Faster containment of threats.
• Reduced Mean Time to Respond (MTTR).
• Unified orchestration across Firewalls, EDR, NAC, and Identity platforms.
• Flexibility to mix manual and automated responses.

Prerequisites

• ADR / EDR deployed and running.
• Admin access to the ADR UI.
• At least one Remediator device (Firewall, EDR, NAC, or Identity provider) configured and tested.

With remediation enabled, ADR can

• Block / Unblock IPs, Domains, or Hosts on firewalls.
• Isolate / Unisolate endpoints on EDR solutions.
• Disable / Enable user accounts on identity providers.

List of Supported Alert Types for Remediation

Configuration Steps

Step 1: Login

1. Open the ADR dashboard
2. Enter your username and password.

Step 2:  Configure Remediator

1. Navigate to Settings → Administration → Remediator
2. Click Add
3. Choose device type and device name (e.g., Palo Alto, FortiGate, CrowdStrike, Azure AD)
4. Enter required details:
   Device IP / Hostname
   Username / API Key / Password
   CCE IP
   Config - Port (default: 443; custom example: {“port”:”8443”})
   Additional configuration fields (if required by device type)
5. Click Save
   
   

Step 3: Test Connection

1. In the Remediator list, select the newly added device
2. Click Test Connection
3. Wait for results:
   • Success → Device is ready for remediation
   • Failure → Error message shown in status field

Step 4: Access Auto Remediation

1. From the side menu, navigate to SOAR & BI → Auto Remediation.
2. Click Add to create a new auto remediation policy.

Step 5: Configure Policy

1. Enable Auto Remediation – check the box.
2. Alert Severity – choose severity levels for auto-remediation:
   • Critical
   • Major
3. Confidence Score Threshold – define the minimum threshold (e.g., 80%).
4. Alert Types – select from supported alert categories (e.g., Policy Violation, Potential Malware Infected Host, etc.).
5. Schedule – define specific days and time windows for enforcement.
6. Endpoint Actions – (ADR EDR-specific):
   • Quarantine File
   • Kill Process
   • Quarantine Host
     Note - ADR EDR supports up to three actions. For other EDR devices, only Quarantine Host is supported. 
7. Remediator Device – select the appropriate device(s) added under Administration → Remediator.
8. Asset Group – assign the asset group(s) where this policy should apply.
9. Click Save.

Step 6: Verify Configuration

1. Confirm that the new policy appears under Auto Remediation.
2. Review and validate parameters: severity, alert types, schedule, device, and asset group.

How It Works (Execution Flow)

1. An alert matching the configured policy criteria (e.g., Policy Violation) is triggered.
   
2. ADR automatically initiates the remediation action.
3. If successful → the alert moves to Remediated state.
4. If unsuccessful → the alert remains in Open state, with failure details shown in Alert History.

Verification

1. Trigger a test alert matching your configured policy (e.g., simulate malicious IP).
2. Confirm the following:
   • Alert state changes: Remediated (success) or Open (failure).
   • Logs confirm remediation request was sent to the device.
   • Enforcement device (Firewall/EDR) console reflects the applied action.