Forensics, incident response, and remediation
This domain tests the investigation and response workflow after a Harmony Endpoint detection. You must know what forensic data is collected, which remote actions are available, and in what order to preserve evidence, contain the host, eradicate the threat, and recover safely.
Forensic data and investigation
- Endpoint Forensics records process creation, file activity, network connections, registry changes, user context, and file hashes into a timeline.
- Use the timeline to establish parent-child process relationships and to search for indicators of compromise such as hashes, paths, domains, and command lines.
- Retention and disk settings determine how far back you can investigate; plan them before an incident.
Incident response actions
From the management console you can isolate an endpoint from the network while preserving management connectivity, terminate a process, quarantine or delete a file, fetch a file for analysis, run a script, and release isolation. Remediation means removing the malicious artifact and verifying the host is clean, not merely closing the alert.
Response order
Detect, scope, preserve volatile evidence, contain, eradicate, recover, and document. Isolation is a containment step; collect process and network data first if it would otherwise be lost. Confirm the file hash before deletion, and keep a copy if it is needed for analysis.
Worked example
An alert shows PowerShell spawned by a Word process. The forensic timeline shows the child process, a downloaded file, and an outbound connection. Before killing the process, fetch the file and record the hash and command line. Then isolate the endpoint, terminate the process, quarantine the file, run a full scan, and release isolation only after the scan and timeline review are clean. Reasoning: evidence is preserved first, containment limits spread, and release is gated on verification rather than on the initial alert closing.
Traps
- Deleting a file before fetching it or recording its hash.
- Isolating immediately and losing volatile process or network evidence.
- Treating quarantine as full remediation without a follow-up scan.
- Running a broad script across many endpoints before scoping the incident.
- Forgetting to release isolation after cleanup.
- Failing to document actions, timestamps, and evidence for later review.