Incident response in a defense setting involves a hard tradeoff. If you fail to contain a genuine intrusion, the attacker can reach more systems. If you act too aggressively on an uncertain alert, you can take down an essential application or operational dependency. A security tool generating an alert does not make either outcome acceptable.
Fidelis Network supports that decision through threat detection, investigation context, configurable security rules, and integration with response technologies. It supports preventive actions through applicable network, email, and web enforcement configurations, and it can share findings with other tools to coordinate response.
The deployment details matter here. Passive sensors observe mirrored traffic and avoid introducing an inline inspection point, but passive visibility alone does not guarantee that a malicious connection can be stopped before it completes. Where prevention is required, defense architects need to validate the supported enforcement path and how it interacts with existing network controls.
For instance, take a suspicious connection originating from a management server. Disconnecting an entire network segment in response is rarely the right first move. The SOC may first need to:
