Once you set and configure a response policy, the system starts a 7-day soaking period. During this time, your response policy will be in report only mode and not trigger any response actions. It will also be shown as "off" in the MDR Portal.
This approach limits the chance of a response action impacting your operations while we understand your organization's network topology and expected behaviors. If a legitimate threat is discovered during this period, response actions will be triggered manually, once it has been reviewed by an analyst.
If you would like to bypass Active Response's soaking period, please reach out to support@fieldeffect.com and to make the request.
If your agents are still showing an "off" status for Active Response after the soak period has passed, reach out to support@fieldeffect.com to investigate further.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article