Views:

Resume containers within previously isolated pods or ECS tasks using the context menu in Response Management.

This task is supported by the following services:
  • TrendAI Vision One™ Container Security
Important
Important
The Resume Container response action becomes available after you isolate a pod or ECS task and examine its behavior.
You can reconnect the pod or ECS task to relevant networks and resume data transfer by selecting Resume Container from the options button (options_icon=GUID-408062FA-DA13-4ECA-81EB-31A5B68355A1=1=en-us=Low.jpg) associated with the corresponding Isolate Container task. You can also trigger Resume Container tasks via the context menu in Attack Surface Discovery, Workbench, Observed Attack Techniques, and the XDR Data Explorer app.

Procedure

  1. After identifying the container to resume, access the options menu or the context menu and click Resume Container.
    The Resume Container Task screen appears.
  2. Confirm the target of the response.
  3. Specify a Description for the response or event.
  4. Click Create.
    TrendAI Vision One™ creates the task and displays the current task status in Response Management.
  5. Monitor the task status.
    1. Go to Workflow and Automation → Response Management .
    2. (Optional) Locate the task using the Search field or by selecting Resume Container from the Action drop-down list.
    3. View the task status.
      • In progress (in_progress=GUID-A55897DB-3DEA-4F5C-B7F9-70B3D7FB9EDE=1=en-us=Low.jpg): TrendAI Vision One™ sent the command and is waiting for a response.
      • Successful (successful=GUID-1E31AD86-DE2E-48B5-85F7-7C78A3E8BB11=1=en-us=Low.jpg): The command was successfully executed.
      • Unsuccessful (error=5cc21722-7ceb-480c-b9c2-a47d420cf1cc.jpg): An error or time-out occurred when attempting to send the command, or the specified pod or ECS task no longer exists.