> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction to Remediation

> Automatic and manual isolation of compromised assets

Remediation allows Wirespeed to isolate Endpoints, Users, and Files when they are associated with malicious detections. Automatic remediation is disabled by default and you should make sure to review case logs with test mode enabled before turning this setting on. During that review ensure your sampling of cases was handled correctly, any remediations appeared correct, and reach out to the Wirespeed team if you see any irregularities. When you are ready to enable automatic remediation, you can modify the settings underneath Settings > Remediation.

Remediation is always enabled manually when reviewing a case and selecting Actions > Remediate or Release.

## Settings > Remediation

The Remediation page under Settings has three tabs:

* **Actions Taken** — shows which remediation actions were taken on your behalf by Wirespeed.
* **Recommended Actions** — shows which remediation actions Wirespeed recommended but could not perform because automatic remediation is disabled or blocked by policy.
* **Configuration** — configure automatic remediation and related settings, including identity, endpoint, and file auto-remediation toggles and the daily remediation limit.

<Info>
  Service provider teams see **Actions Taken** and **Recommended Actions** across managed clients. The **Configuration** tab is available on individual tenant teams only.
</Info>

<Warning>
  Auto-remediation is not performed for detections from beta integrations. If a detection is generated by a beta integration, Wirespeed will skip automatic remediation and escalate the case to your team instead. Manual remediation is still available for these detections.
</Warning>

## Supported actions

Wirespeed supports the following remediation and release actions. Which actions are available for a given asset depends on your connected integrations and the actions configured on the matching [verdict rule](/verdicts/introduction#remediation).

| Asset type   | Remediation actions                              | Release actions                   |
| ------------ | ------------------------------------------------ | --------------------------------- |
| **User**     | Disable Account, Reset Password, Revoke Sessions | Enable Account                    |
| **Endpoint** | Isolate Endpoint, Lock Device                    | Unisolate Endpoint, Unlock Device |
| **File**     | Quarantine File, Delete File                     | Unquarantine File                 |

See [User Remediation](/remediation/users), [Endpoint Remediation](/remediation/endpoints), and [File Remediation](/remediation/files) for details on each asset type.

<Tip>
  Verdict rules control which specific actions run for a detection. Global remediation settings under Settings > Remediation must also be enabled for automatic remediation to proceed; otherwise the detection is escalated. [Groups](/groups/introduction) can disable remediation for specific assets even when global settings are on.
</Tip>

## Max Auto Remediations Per Day

This setting allows you to configure the maximum number of auto remediations that can be performed per day. This is useful if you want to limit the number of auto remediations that can be performed to avoid excessive use of the feature. Once this limit is reached, auto remediations will be stopped for the remainder of the day and cases will be escalated to your team instead.

If a case contains more than 10 users or endpoints, remediation will be skipped and the case will be escalated to your team instead.