I'd like some help in better understanding the Preventative action type.
What is unique to a Preventative action that is different from Remediative or Mitigative? I recognize that there is some overlap, however it would be great to have 1 example to demonstrate the uniqueness of Preventative that would qualify it as needing its own action type.
In order to try and get my head around this, I did a quick matrix of the current examples and mapped them to each action type. What I'm not seeing is a use case where Preventative would not have already been categorized as either mitigative or preventative.
Does anyone have a good and unique example for Preventative?
Known Threat Blocking Rules Affect Policies Blackhole Sinkhole Blacklist Patch
Investigative Maybe N N N N N N
Mitigative Y Y Y Y Y Y Y
Remediative Y Y Y
Y
Preventative Y Y Y Y Y Y Y
Thanks -A
--
Andrew Storms
VP of Security Services
P
707-477-4335
