🛡️
How Auto-Remediation Works
Auto-remediation automatically responds to threats without waiting for manual intervention. When a CRITICAL or HIGH severity threat is detected, the agent takes immediate action.
● Automated Actions
| Action | Trigger | Risk | Auto? |
|---|---|---|---|
| 🚫 Block IP | CRITICAL/HIGH external attacks | LOW | ✅ Yes |
| 💀 Kill Process | Suspicious process detected | MEDIUM | ✅ Yes |
| 📁 Quarantine File | Ransomware/malware | MEDIUM | ✅ Yes |
| 🔌 Isolate Host | Confirmed compromise | HIGH | ⚠️ Manual |
● What is NEVER Auto-Blocked
- Private IPs (10.x.x.x, 192.168.x.x, 172.16.x.x)
- Your own server IPs (learned from heartbeats)
- Whitelisted IPs (configured in Settings)
- LOW/MEDIUM severity events
✅ Toggle auto-remediation: Settings → Auto-Remediation switch (ON/OFF)