Response actions: kill, quarantine, scan — and the audit trail

One-click response with a one-minute delivery promise and a permanent record.

1. 1Actions launch from a device row (isolate) or a detection page (isolate, kill, quarantine, scan).
2. 2Protected devices poll for commands every 60 seconds — actions land in about a minute, and each is acknowledged back with a result.
3. 3Kill terminates the process and its children; quarantine encrypts the file into the local store; scan launches a Defender quick scan.
4. 4The Response page is the immutable audit log: every action, who requested it, when, and how it completed. Auditors love it.