{"id":7623,"date":"2024-11-08T10:17:22","date_gmt":"2024-11-08T08:17:22","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=announcement&p=7623"},"modified":"2026-10-19T13:08:44","modified_gmt":"2026-10-19T10:08:44","slug":"xdr-response-actions-now-available-on-mac-and-linux-fr","status":"publish","type":"announcement","link":"https:\/\/support.withsecure.com\/fr\/announcements\/xdr-response-actions-now-available-on-mac-and-linux-fr\/","title":{"rendered":"XDR Response Actions – D\u00e9sormais disponible sur Mac et Linux"},"content":{"rendered":"

Pr\u00e9c\u00e9demment, nous avons pr\u00e9sent\u00e9 Actions de r\u00e9ponse<\/a> pour la version Windows de notre client XDR.<\/p>\n

Gr\u00e2ce aux actions de r\u00e9ponse, vous pouvez extraire des artefacts forensiques sp\u00e9cifiques des points finaux afin de recueillir davantage d’informations et de fournir un contexte suppl\u00e9mentaire \u00e0 une enqu\u00eate sur des \u00e9v\u00e9nements suspects qui ont \u00e9t\u00e9 d\u00e9tect\u00e9s. Vous pouvez \u00e9galement ralentir ou emp\u00eacher un attaquant d’atteindre ses objectifs en contenant les menaces au moment o\u00f9 elles sont d\u00e9couvertes et en les bloquant imm\u00e9diatement. Cette op\u00e9ration peut \u00eatre effectu\u00e9e sur plusieurs points d’acc\u00e8s en m\u00eame temps si n\u00e9cessaire.<\/p>\n

Ces actions ont consid\u00e9rablement aid\u00e9 nos partenaires et nos clients \u00e0 travailler sur les d\u00e9tections, et nous avons maintenant ajout\u00e9 les actions de r\u00e9ponse \u00e0 nos agents Mac et Linux.<\/p>\n

Pour utiliser les actions Advanced Response, la fonctionnalit\u00e9 doit \u00eatre activ\u00e9e dans les profils utilis\u00e9s. Ce param\u00e8tre se trouve dans les param\u00e8tres \u00ab\u00a0G\u00e9n\u00e9raux\u00a0\u00bb des profils Windows\/Mac\/Linux.<\/p>\n

En raison de la nature des syst\u00e8mes d’exploitation h\u00f4tes, toutes les plateformes ne prennent pas en charge toutes les actions.<\/p>\n

Actions d’enqu\u00eate<\/h2>\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

Action de r\u00e9ponse<\/strong><\/p>\n<\/th>\n

\n

Fen\u00eatres<\/strong><\/p>\n<\/th>\n

\n

Mac<\/strong><\/p>\n<\/th>\n

\n

Linux<\/strong><\/p>\n<\/th>\n<\/tr>\n<\/thead>\n

\n

R\u00e9cup\u00e9rer des fichiers<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n<\/tr>\n

\n

R\u00e9cup\u00e9rer l’historique Powershell<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer les entr\u00e9es du journal des \u00e9v\u00e9nements<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer les fichiers du journal des \u00e9v\u00e9nements<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer les entr\u00e9es de tra\u00e7age du journal des \u00e9v\u00e9nements<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer les journaux de l’antivirus<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer les artefacts du navigateur<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer les fichiers jumplist<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer MFT<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer les fichiers de cache RDP<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer les ruches du registre<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer la base de donn\u00e9es System Resource Usage Monitor<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

Registre des cartes<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer le MBR<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer Amcache<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer Pr\u00e9voir<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

R\u00e9cup\u00e9rer les donn\u00e9es r\u00e9cemment consult\u00e9es<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

Cartographier le syst\u00e8me de fichiers<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n<\/tr>\n

\n

Netstat<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n<\/tr>\n

\n

\u00c9num\u00e9rer les processus<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n<\/tr>\n

\n

\u00c9num\u00e9rer les t\u00e2ches programm\u00e9es<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

\u00c9num\u00e9rer les services<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

\u00c9num\u00e9rer la persistance WMI<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

Vidage de la m\u00e9moire du processus<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n\n

Oui<\/p>\n<\/td>\n<\/tr>\n

\n

Vidage complet de la m\u00e9moire<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n\n

Oui<\/p>\n<\/td>\n<\/tr>\n

\n

Tester les connexions<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Mesures de confinement<\/h2>\n
\n\n\n\n\n\n\n
\n

Action de r\u00e9ponse<\/strong><\/p>\n<\/th>\n

\n

Fen\u00eatres<\/strong><\/p>\n<\/th>\n

\n

Mac<\/strong><\/p>\n<\/th>\n

\n

Linux<\/strong><\/p>\n<\/th>\n<\/tr>\n<\/thead>\n

\n

Tuer le processus<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n<\/tr>\n

\n

Tuer le fil<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Mesures d’assainissement<\/h2>\n
\n\n\n\n\n\n\n\n\n\n
\n

Action de r\u00e9ponse<\/strong><\/p>\n<\/th>\n

\n

Fen\u00eatres<\/strong><\/p>\n<\/th>\n

\n

Mac<\/strong><\/p>\n<\/th>\n

\n

Linux<\/strong><\/p>\n<\/th>\n<\/tr>\n<\/thead>\n

\n

Supprimer des fichiers<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n<\/tr>\n

\n

Supprimer le registre<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

Supprimer des t\u00e2ches programm\u00e9es<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

Supprimer les services<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n
\n

Supprimer la persistance WMI<\/p>\n<\/td>\n

\n

Oui<\/p>\n<\/td>\n

<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Pour plus d’informations sur les types d’\u00e9v\u00e9nements, veuillez consulter le site web de la Commission europ\u00e9enne. guide de l’utilisateur<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Pr\u00e9c\u00e9demment, nous avons pr\u00e9sent\u00e9 Actions de r\u00e9ponse pour la version Windows de notre client XDR. Gr\u00e2ce aux actions de r\u00e9ponse, vous pouvez extraire des artefacts forensiques sp\u00e9cifiques des points finaux…<\/p>\n","protected":false},"template":"","announcement_category":[142],"class_list":["post-7623","announcement","type-announcement","status-publish","hentry"],"acf":{"source_system":"vanilla-import","import_hash":"e4c52ede72fe14084b622ebca06236efffa95711","vanilla_article_id":31426,"legacy_author":"AndyF_WS","vanilla_url":"https:\/\/community.withsecure.com\/announcements-fr\/kb\/articles\/31426-xdr-response-actions-now-available-on-mac-and-linux","vanilla_category_id":142,"machine_translated":true},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/announcement\/7623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/types\/announcement"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/announcement\/7623\/revisions"}],"predecessor-version":[{"id":8480,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/announcement\/7623\/revisions\/8480"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/media?parent=7623"}],"wp:term":[{"taxonomy":"announcement_category","embeddable":true,"href":"https:\/\/support.withsecure.com\/fr\/wp-json\/wp\/v2\/announcement_category?post=7623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}