Initiate a Blocklist Remediation

You can add indicators of compromise (IOCs) to the Digital Risk Protection (Threat Command) internal Remediation Blocklist. Users of Digital Risk Protection (Threat Command) Automation can feed the blocklist to an internal security device.

Initiate a blocklist remediation

To initiate a blocklist remediation:

1. Go to Alerts > Digital Risk Protection > DRP Alerts.
2. Click on an alert from the alerts list.
3. From the Alert options  section, click the IOCs icon.
   • If the IOCs icon is not displayed, the selected alert is not a candidate for blocklist remediation.
4. To add an IOC to the blocklist, hover over the IOC and click the + sign.
   • When an IOC has been added to the blocklist, a check is displayed.

For more information on feeding the blocklist to internal security devices, see Automate Internal Remediation.