Skip to main content
Remediation allows Wirespeed to isolate Endpoints, Users, and Files when they are associated with malicious detections. Automatic remediation is disabled by default and you should make sure to review case logs with test mode enabled before turning this setting on. During that review ensure your sampling of cases was handled correctly, any remediations appeared correct, and reach out to the Wirespeed team if you see any irregularities. When you are ready to enable automatic remediation, you can modify the settings underneath Settings > Remediation. Remediation is always enabled manually when reviewing a case and selecting Actions > Remediate or Release.

​
Settings > Remediation

The Remediation page under Settings has three tabs:
  • Actions Taken — shows which remediation actions were taken on your behalf by Wirespeed.
  • Recommended Actions — shows which remediation actions Wirespeed recommended but could not perform because automatic remediation is disabled or blocked by policy.
  • Configuration — configure automatic remediation and related settings, including identity, endpoint, and file auto-remediation toggles and the daily remediation limit.
Service provider teams see Actions Taken and Recommended Actions across managed clients. The Configuration tab is available on individual tenant teams only.
Auto-remediation is not performed for detections from beta integrations. If a detection is generated by a beta integration, Wirespeed will skip automatic remediation and escalate the case to your team instead. Manual remediation is still available for these detections.

​
Supported actions

Wirespeed supports the following remediation and release actions. Which actions are available for a given asset depends on your connected integrations and the actions configured on the matching verdict rule. See User Remediation, Endpoint Remediation, and File Remediation for details on each asset type.
Verdict rules control which specific actions run for a detection. Global remediation settings under Settings > Remediation must also be enabled for automatic remediation to proceed; otherwise the detection is escalated. Groups can disable remediation for specific assets even when global settings are on.

​
Max Auto Remediations Per Day

This setting allows you to configure the maximum number of auto remediations that can be performed per day. This is useful if you want to limit the number of auto remediations that can be performed to avoid excessive use of the feature. Once this limit is reached, auto remediations will be stopped for the remainder of the day and cases will be escalated to your team instead. If a case contains more than 10 users or endpoints, remediation will be skipped and the case will be escalated to your team instead.