Skip to main content
After Wirespeed receives a detection from one of your integrations, it is categorized and goes through the process of verdicting. Verdicts are a series of enrichments and checks we perform on detections and related data in your environment to determine what actions should be performed. Below are a few examples from the Endpoint > Execution detection verdicts: Verdicts Each rule shows when it runs (for example Immediate), the condition that must be true (if), and the actions Wirespeed takes (then). When remediation actions are enabled, the outcome lists the specific actions in parentheses — for example, Remediate Endpoint (Isolate Endpoint, Lock Device). The verdicts are processed in a top down order. If the first verdict is not true, it continues until a true verdict is reached or we hit the default verdict. You can customize these verdicts to tune Wirespeed to your environment.

​
Customizing Verdicts

When editing a verdict rule, you can configure remediation actions, response options, verdict, and severity.

​
Remediation

Remediation actions automatically remediate or release users, endpoints, and files associated with a detection, and can delete the mailbox rule a detection reports. For each asset type, you can choose which specific actions to perform.

​
Remediate User

Lock down users associated with this detection. Available actions:
  • Disable Account — prevent the user from signing in
  • Require MFA Re-enrollment — remove registered MFA methods and require enrollment again (destructive and one-shot)
  • Reset Password — force a password change on next sign-in
  • Revoke Sessions — terminate all active sign-in sessions

​
Remediate Endpoint

Isolate endpoints associated with this detection. Available actions:
  • Isolate Endpoint — disconnect the endpoint from the network
  • Lock Device — remotely lock the device screen

​
Remediate File

Quarantine or delete files associated with this detection. Available actions:
  • Quarantine File — quarantine the file to prevent execution
  • Delete File — permanently delete the file from the endpoint (irreversible)

​
Delete Mailbox Rule

Permanently delete the malicious mailbox rule reported by this detection (irreversible). This option only appears on Malicious verdict rules in the Mailbox Rule category. See Mailbox Rule Remediation for requirements and limits.

​
Release User

Reverse user remediation when a detection is resolved as benign:
  • Enable Account — re-enable the user account for sign-in

​
Release Endpoint

Reverse endpoint remediation when a detection is resolved as benign:
  • Unisolate Endpoint — reconnect the endpoint to the network
  • Unlock Device — unlock the device screen

​
Release File

Reverse file remediation when a detection is resolved as benign:
  • Unquarantine File — release the file from quarantine
If a detection matches a verdict rule with remediation actions configured, but the corresponding global auto-remediation setting is disabled, the detection will be escalated to your team. See User Remediation, Endpoint Remediation, File Remediation, and Mailbox Rule Remediation for details.

​
Response

​
Escalate

Notify your team about the detection for manual investigation.

​
Correlate & Resolve

Resolve the detection and allow it to be used as a threat indicator for other cases.

​
Skip

Ignore this verdict and continue on. You cannot skip the default rule.

​
Chat Ops

Chat Ops is an add-on that is only available with Escalate. Correlate & Resolve, Skip, and Run Monitors rules cannot use it. Containment can run on the same rule. Wirespeed applies the verdict first: any containment on the rule runs, then the detection is escalated. Wirespeed then messages the user(s) affected by this detection and asks whether they performed the activity. It does not wait for a reply before escalating.
  • Yes, this was me — the detection closes as Benign and reversible remediation is released.
  • No, this wasn’t me — Wirespeed adds a timeline entry, keeps the detection escalated, and runs every non-destructive containment action on the user, endpoint and files, even when the rule has none. A reply from an IP address linked to the detection counts as Yes, this was me.
  • I’m not sure — Wirespeed adds a timeline entry and the detection stays escalated.
  • No reply within the reply window set under Settings > Chat Ops — the prompt is marked unanswered and the outcome stays in place. A reply that arrives later is recorded on the timeline for your security team but does not change the outcome.
Additional options are available:
  • Chat Ops MFA — require SMS MFA when a user claims they performed the activity (requires Chat Ops Second Factor in team settings)
  • VIP Chat Ops — allow Chat Ops for VIP users on this rule
Wirespeed’s default verdict rules leave Chat Ops off, except the Account Compromise rule that asks the user to confirm the activity when the matching managed rule has not met its review threshold. Every other prompt comes from your own rules set to Escalate with Chat Ops on. See Chat Ops for details.