Endpoint
EDR
Agents, alerts, and what the agent actually blocked. Pending items still need an analyst.
Agents
2,460
97% checked in
Offline
61
Oldest is AMHS-WS-0122 at West Clinic
Blocks
355
Mitigations in the window
Alerts
1,218
1 still pending in the notable set
Alerts and blocks
3 hosts are isolated. 8 agents are waiting on an upgrade.
- Alerts
- Blocks
Alert mix
Share of alerts in the window, not a count of hosts.
Malware414
Suspicious script219
Potentially unwanted219
Exploit146
Lateral movement122
Ransomware97
Notable threats
The storylines tied to investigations, plus anything still pending.
| Id | When | Agent | Class | Mitigation | Detail |
|---|---|---|---|---|---|
| S1-91888 | 17 Oct 17:08 | AMHS-WS-2011 West Clinic | Suspicious script | Pending | PowerShell spawned from a document. Analyst has not confirmed the storyline. |
| S1-91702 | 17 Oct 13:08 | AMHS-WS-0902 HQ | Malware | Blocked | Second-stage write blocked. |
| S1-91644 | 17 Oct 07:08 | AMHS-WS-2210 West Clinic | Malware | Quarantined | Macro loader quarantined before egress. |
| S1-91820 | 17 Oct 04:08 | AMHS-WS-1844 East Campus | Ransomware | Killed | Encryption behavior killed. Host isolated. |
| S1-91410 | 15 Oct 00:08 | AMHS-WS-0441 HQ | Suspicious script | Killed | Obfuscated script killed. Download blocked. |
| S1-90990 | 13 Oct 22:08 | AMHS-WS-0448 HQ | Ransomware | Killed | Shadow-copy tamper blocked. Encryption killed. |
| S1-90112 | 9 Oct 14:08 | AMHS-KIOSK-12 HQ | Potentially unwanted | Quarantined | Adware installer quarantined. |
| S1-89880 | 7 Oct 02:08 | AMHS-WS-1519 East Campus | Ransomware | Blocked | Tamper protection held. No encryption. |