The User Activity page lists all the remediation activities performed on the events, with the following details:
- The requested remediation action along with the date and time.
- The object (file/process) and the asset on which the action is performed.
- The user who performed the remediation action.
- The current status of the remediation action.
For additional information about the remediation action, click on the remediation action from the Requested Activity column. In this case, if you click Quarantine File, a new window opens where you can view details of the action.
This option allows you to restore the quarantine file back to its original position.
1) Click Responses > User Activity.
2) From the list, select a quarantine file event and from the Status column, click UnQuarantine.
3) The UnQuarantine File window is displayed. Enter the required comment and click Execute Action.
4) You can track the progress of the action in the Status column of the User Activity tab.
This option allows you to retry the remediation action on failed events.
1) Select the Failed remediation event and click Retry from the Status column.
2) You will be redirected to the Hunting tab. From the Remediation Action column, select the required remediation option.
