Why is Active Response showing as "Off" after I set a policy?

Once you set and configure a response policy for the first time as a new client, the system starts a 7-day soaking period. For the first two days, your response policy will be in report only mode and not trigger any response actions. After two days, it will activate the Limited policy. Once the soaking period concludes, your desired response policies and customizations will be active.  

This approach limits the chance of Active Response to block valid activity, that may appear malicious, while our MDR learns what normal looks like for your organization. If a legitimate threat is discovered during this period, response actions will be triggered manually, once it has been reviewed by an analyst. If a legitimate threat is discovered during this period, response actions will be triggered manually, once it has been reviewed by an analyst.

If you would like to bypass Active Response's soaking period, please reach out to support@fieldeffect.com and to make the request.

If your agents are still showing an "off" status for Active Response after the soak period has passed, reach out to support@fieldeffect.com to investigate further.