How can I manage Active Response for a single endpoint?

When enabling Active Response, you are asked to set a Response Policy that dictates your organization's tolerance for risk, which informs Active Response as to how aggressively it should respond to threats and other indicators of compromise.

While you can use the Bulk Editing feature to change the Active Response status for many endpoint devices, you can also use Bulk Editing to edit only a single endpoint device. When the bulk editor's sector buttons become visible on the Devices page, only select the single device and make your changes. 

See our Help Center article on Bulk Editing on the Devices page to perform this task.