Perform actions to Suspicious Activity events in Nebula

Suspicious Activity Monitoring is a feature included in Malwarebytes Endpoint Detection and Response. It watches for potentially malicious behavior by monitoring the processes, registry, file system, and network activity on the endpoint. 

Suspicious Activity Monitoring uses machine learning models and cloud-based analysis to detect when questionable activity occurs. This article explains how to remediate Suspicious Activity or close the incident as benign.

View and sort suspicious activity

The main area of the Suspicious Activity screen shows the list of all suspicious threat data. Each column can be filtered to narrow the results. You can customize data in the results list in the following ways:

• Click Add / Remove Columns above the results list to choose which columns to display.
• Drag and drop certain column headers to the results bar to group data by those parameters.
• Use the filters  in the column headers to view specific data.
• Hover your cursor over a column header to reveal a hamburger icon  with options to pin and auto-size columns.

Perform action to suspicious activity

1. On the left navigation pane, click Investigate > Suspicious Activity.
2. In the Suspicious Activity table, you can review suspicious activity details including machines with detections, severity of the threats, and date/time of the detections. You can take action on an item or drill down into the cause of the detection in Actions column. In the Status column, new items display as Suspicious Activity Found.
   
3. In the Location column, click detected item to view additional details. A process graph displays associated activity, rules triggered by the detection, and additional context. The additional context includes paths, hashes, specific registry modifications, file reads/writes and process IDs. To learn more, see Suspicious Activity Details in Nebula.
4. In the Actions column, click the ellipsis icon (  ) to choose either of the following actions:
   • Isolate Endpoint: Block network connections, processes, and/or user activity on the endpoint until the isolation is removed.
   • Remove isolation: Remove isolation on an endpoint. The endpoint will automatically reboot.
   • Remediate. Remediate the suspicious activity found on the endpoint.
   • Close Incident. When closing an incident, you have the option to create an exclusion for it. Exclusions prevent this item from triggering future Suspicious Activity events. If you want to reopen the incident, click the ellipses icon (  ) and choose Open Incident. You can choose one of the following exclusion options:
     • Command Line. Exclude script and parameters run through Windows Command Line. 
     • MD5 Hash. Exclude files using their MD5 Hash value. If an MD5 Hash is not available, a File by Path exclusion is created instead through Nebula.  
   • Upload File: Uploads the suspicious file to the sandbox analysis section for review. For more information, see Sandbox Analysis in Nebula.
   • Launch Active Response Shell: Securely connect to remote workstations and servers (Windows only) to investigate attacks, collect diagnostic data, and remediate breaches.

Perform bulk action to suspicious activity

1. On the left navigation pane, click Investigate > Suspicious Activity.
2. Select multiple incidents with the same Status. Then in the top right corner, click Bulk Actions. Certain actions display based on the selected incidents.
3. Choose one of the following actions:
   • Isolate Endpoint: Block network connections, processes, and/or user activity on the endpoint until the isolation is removed.
   • Remove Isolation: Remove isolation on an endpoint. The endpoint will automatically reboot.
   • Remediate: Remediate the suspicious activity found on the endpoint.
   • Close Incident: Mark the incident as closed.
   • Open Incident: Re-open a closed incident.
   • Upload File: Uploads the suspicious file to the sandbox analysis section for review. 

Return to the Malwarebytes Nebula Administrator Guide.