We don't recommend turning on this setting unless doing so outweighs the benefits of incident correlation across the entire organization. However, global SOC will see several different incidents by device group instead of one incident. The local SOC can then take action on the incident because they have access to one of the device groups involved.
By turning on this setting, an incident composed of alerts that cross device groups will no longer be considered a single incident. This configuration can be used for scenarios where local SOC operations would like to limit alert correlations only to device groups that they can access. Restrict correlation to within scoped device groups When turned off, remediation is dependent on the device configuration. This will help protect users from inadvertently installing unwanted applications on their device. Turn on this feature so that potentially unwanted applications (PUA) are remediated on all devices in your tenant even if PUA protection is not configured on the devices. Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software, which might be unexpected or unwanted. Live response unsigned script executionĮnabling this feature allows you to run unsigned scripts in a live response session. Turn on this feature so that users with the appropriate permissions can start a live response session on servers.įor more information about role assignments, see Create and manage roles. Turn on this feature so that users with the appropriate permissions can start a live response session on devices.įor more information about role assignments, see Create and manage roles. For more information, see Automated investigation. Turn on this feature to take advantage of the automated investigation and remediation features of the service. Use the following advanced features to get better protected from potentially malicious files and gain better insight during security investigations.
0 kommentar(er)
