Skip to main content
Remediation allows Wirespeed to isolate Endpoints, Users, and Files, and to delete malicious mailbox rules, when they are associated with malicious detections. Automatic remediation is disabled by default: the Enable Automated Remediations switch at the top of Settings > Remediation is off for new customer accounts (service provider accounts always have it on), and you should review case logs before turning it on. During that review ensure your sampling of cases was handled correctly, any remediations appeared correct, and reach out to the Wirespeed team if you see any irregularities. When you are ready to enable automatic remediation, you can modify the settings underneath Settings > Remediation. Remediation is always enabled manually when reviewing a case and selecting Actions > Remediate or Release. Mailbox rule deletion is the exception: it only runs automatically from verdict rules.

​
Settings > Remediation

The Remediation page under Settings has three tabs:
  • Actions Taken — shows which remediation actions were taken on your behalf by Wirespeed.
  • Actions Blocked — shows automatic remediations that did not run because automated remediations are off, or because of a team toggle, group policy, daily limit, or a similar control.
  • Configuration — turn automated remediations on or off for your account and choose which identity, endpoint, file, and mailbox rule remediations run automatically. While the account switch is off, the individual settings are locked but keep their values.
Service provider teams see Actions Taken and Actions Blocked across managed clients. The Configuration tab is available on individual tenant teams only.
Auto-remediation is not performed for detections from beta integrations. If a detection is generated by a beta integration, Wirespeed will skip automatic remediation and escalate the case to your team instead. Manual remediation is still available for these detections.

​
Supported actions

Wirespeed supports the following remediation and release actions. Which actions are available for a given asset depends on your connected integrations and the actions configured on the matching verdict rule. See User Remediation, Endpoint Remediation, File Remediation, and Mailbox Rule Remediation for details on each asset type.
Verdict rules control which specific actions run for a detection. Global remediation settings under Settings > Remediation must also be enabled for automatic remediation to proceed; otherwise the detection is escalated. Groups can disable remediation for specific assets even when global settings are on.

​
Daily Remediation Limit

By default, Wirespeed performs at most 100 automated remediations in any rolling 24-hour period for each account. Accounts with a different configured limit, including no limit, keep that limit. Once the limit is reached, automated remediations stop and cases are escalated to your team instead, until earlier remediations age out of the 24-hour window. Contact the Wirespeed team if your account needs a different limit. If a case contains more than 10 users or endpoints, remediation will be skipped and the case will be escalated to your team instead.