Incident containment actions (Northstar)
From the Incidents view, the Containment actions section provides options for managing an incident.
Block IP: Lets you specify IP addresses that you want to add to a denylist
View runbook: Lets you view Contrast-supplied details and remediation steps for the incident
Escalate: Lets you notify a team member that you want them to investigate an incident
Configure ADR rules:Lets you change the mode for ADR rules. For example, you might want to set an ADR rule to Block instead of Monitor.
Add exclusion: Lets you add exclusions for applications if you want to suppress incidents that Contrast normally reports. You might want to use exclusions if you are using an external security control outside of the scope of Contrast's agent instrumentation.