SE RVICE BRIE F

Rapid7 Active Response
Accelerate Response with Expert-Led Detection and Automation
In 2023, the mean time to identify (MTTI) a security breach was 204 days, and themean time to contain (MTTC) was 73 days1. These averages have been consistentover the last 5 years. Finding and eradicating attacker activity in modern environments
is tough. Breaches are costly and erode customer trust.
The longer an adversary is left to dwell in an organization’s environment, the moredamage they can cause, and the wider the possible blast radius of a breach.
Effective detection and response programs not only isolate attacker behavior, buthalt an attack immediately.
Rapid7’s Active Response - included in all Managed Threat Complete subscriptions- brings the power of expert-led containment to your SOC. Within seconds of avalidated threat, analysts can quarantine an endpoint or user group, stopping anattack before it can cause costly damage or expand the scope of impact.

Configure response actions that work best for your structureand needs, directly within InsightIDR.
Access complete visibility into actions taken on your behalf
with investigation trees and audit logs.
Use the tools that work for your environment, with support
for the Insight Agent and pre-built integrations across yourecosystem.

Rapid7 MDR
provides thedepth of support
we need. It
does more thanjust collect andsend logs, it isactively looking
for threats. And,
if it spots one,it will interceptthat threat
immediately. It
is that proactive
piece that makes
Rapid7 MDR
an effective
program for us.
AMN Healthcare Partners

Unquarantine with the click of a button for complete oversightand control.

Containment on Your Terms:• 24x7, End-to-End Detection and Response. No frantic “drop everything andrespond now” moments. Sleep easy knowing that Rapid7’s MDR experts will takeaction for you at any time, day or night. Our team will monitor threats, validate
them, and take on the initial countermeasures to paralyze the attacker for you.

• Contain users and hosts on-premise or remotely. Active Response will reactas early in the kill chain as possible by containing compromised endpoints
or user accounts. Taking action to respond within minutes of finding a threat
will prevent malware propagation, cut off lateral movement, and stop data
exfiltration attempts.

1 IBM’s 2023 Cost of a Data Breach Report1• Set configurations and guidelines for any response action. You can createcontainment guardrails to prohibit response actions to critical servers, users, ordevices. We won’t treat a typical user the same as your domain admin credentials.

• Deal with eradication and recovery on your terms. Following an Active Response

engagement, you’ll receive a detailed remediation and mitigation guide in yourIncident Report to help build resilience against future attacks. From there, you canremove the device from quarantine directly within the investigation in InsightIDR.

How Active Response Works
Report + Follow-up
MDR Analyst determines fullattacker timeline and actions for
final Incident Report.

Attacker Contained
Customer takes additional initial
remediation and mitigation
recommendations provided by
MDR analyst. Rapid7 Customer
Advisor reaches out to ensure
actions are taken and answer
any questions.

RESILIENCE

Attacker Activity Detected
Rapid7 MDR Team detects
suspicious behavior on anendpoint or with a user.

ALERTCONTAININVESTIGATE

Investigation Begins
Rapid7 analyzes available data,
determines activity is malicious.

RESPOND
Active Response Kicks Off
MDR analyst kicks off Active Response automation toquarantine and take impacted users or assets offline.
Details are available in InsightIDR for customer visibility.

About Rapid7
Rapid7 is creating a more secure digital future for all by helping organizations strengthen theirsecurity programs in the face of accelerating digital transformation. Our portfolio of best-in-classsolutions empowers security professionals to manage risk and eliminate threats across the entire
threat landscape from apps to the cloud to traditional infrastructure to the dark web. We foster open
source communities and cutting-edge research–using these insights to optimize our products andarm the global security community with the latest in attacker methodology. Trusted by more than
11,000 customers worldwide, our industry-leading solutions and services help businesses stay aheadof attackers, ahead of the competition, and future-ready for what’s next.

PRODUCTSCONTACT US

Cloud Security

Application SecurityXDR & SIEM

Orchestration & Automation

Threat Intelligence

Managed Services

rapid7.com/contact

Vulnerability Risk Management
To learn more or start a free trial, visit: https://www.rapid7.com/try/insight/
2