If you cannot confirm execution status, trace the source email, or determine whether other users received the same message, the incident is still incomplete. Containment of the file does not equal containment of the campaign. A resolved alert should close the delivery path, not just the endpoint artefact.
What indicates the alert is not really closed?
An EDR alert is still unresolved when the file was blocked or quarantined, but the delivery path, execution path, or recipient scope has not been fully ruled out. The key question is whether the activity stopped at an endpoint artifact, or whether the wider campaign has been identified and closed out. If you cannot answer the chain end to end, the alert remains open.
A contained file is only one control outcome. It does not tell you whether the same message was delivered elsewhere, whether another copy executed before containment, or whether the original email, attachment, or download source is still active. In practice, “resolved” means you have enough evidence to show the alert no longer represents an ongoing exposure.
What evidence shows the campaign is still active?
The strongest sign of an unresolved case is missing visibility into what happened before and after the containment action. If you cannot confirm execution status, trace the source email, or determine whether other users received the same message, you still have a live investigative gap. That gap matters because the malicious content may have already propagated beyond the first endpoint.
Correlate the EDR event with mail, proxy, identity, and endpoint telemetry. A single quarantined file may be a symptom, not the root cause. If the file was delivered through email, the unresolved question is not just whether the file is blocked on one host, but whether the message was opened, forwarded, or delivered to additional mailboxes. For campaign closure, the delivery mechanism must be addressed as a security path, not just the endpoint object.
How do you decide the alert can be closed?
A practical closure decision requires three confirmations: the suspicious file or process is no longer active, the originating delivery path has been identified and contained, and the recipient scope has been checked for similar exposure. If any one of those is unknown, the alert should stay in an investigative state rather than be marked resolved.
That is why endpoint containment alone is not enough. A true resolution should close the path that introduced the file, show there is no remaining execution opportunity, and establish whether remediation needs to expand to other users or systems. If the investigation stops at the first host, you risk declaring success before the campaign has actually been interrupted.
Risk and Threat Considerations
File containment can create a false sense of closure when the attacker’s delivery route is still intact. The main risk is that the same payload, or a related message, remains available to other recipients or can be reintroduced through the original channel. That turns a local endpoint event into a broader exposure across mail, download, or user interaction paths.
Failure mechanism: The control stops the file on one endpoint, but does not verify execution history, message spread, or source containment, so the campaign can continue through other copies or recipients.
Impact: Teams may miss additional compromised users, leave the initial delivery mechanism open, and prematurely close an incident that still has active blast radius.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1204 — User Execution | The alert may still be open if the user opened or ran the delivered file. |
| T1566 — Phishing | Email delivery and repeat recipients are central to deciding whether the campaign is still active. | |
| Recommendation — Map the delivery chain to user-execution evidence and verify whether the payload actually ran. Trace the phishing delivery path and hunt for other recipients of the same message. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | EDR containment and campaign follow-up are core malware defense operations. |
| Recommendation — Correlate EDR containment with mail and endpoint telemetry to confirm the threat is fully interrupted. | ||
Practitioner Guidance
What to verify: Confirm whether the file ever executed, whether the source message or download location is still reachable, and whether any other users received the same content. If you only have endpoint containment evidence, treat the alert as incomplete.
Decision rule: If the alert is tied to email, trace the message path and recipient set before closure. If it is tied to web or file transfer, validate the source URL, download lineage, and any other hosts that touched the same artifact.
What good looks like: The endpoint object is contained, the delivery mechanism is remediated, and the investigation has ruled out additional exposure. At that point, the alert is no longer just “blocked”, it is genuinely closed.
Practitioner takeaway: Close on campaign containment, not file containment. The endpoint action is only complete when you can show the delivery path and any related recipient exposure have also been accounted for.