Once you set and configure a response policy for the first time as a new client, the system starts a 7-day soaking period. For the first two days, your response policy will be in report only mode and not trigger any response actions. After two days, it will activate the Limited policy. Once the soaking period concludes, your desired response policies and customizations will be active. During this soaking period, it's also important to note that Active Response will be shown as "off" in the MDR Portal.
This approach limits the chance of a response action impacting your operations while we understand your organization's network topology and expected behaviors. If a legitimate threat is discovered during this period, response actions will be triggered manually, once it has been reviewed by an analyst.
If you would like to bypass Active Response's soaking period, please reach out to support@fieldeffect.com and to make the request.
If your agents are still showing an "off" status for Active Response after the soak period has passed, reach out to support@fieldeffect.com to investigate further.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article