Explore Expel’s auto remediations: Kill process

This document describes Expel's "kill process" auto-remediation: a human-validated, EDR-driven workflow that enables SOC analysts to rapidly terminate confirmed malicious processes (for example ransomware, RATs, or malicious scripts) via platforms like Microsoft Defender for Endpoint and CrowdStrike Falcon. It outlines typical triggers (high-confidence EDR alerts, suspicious behavior, threat hunting, correlated signals), customer pre-approval checks, and the five-step flow (detection, validation & context, customer approval, execution, confirmation) intended to minimize attacker dwell time and limit impact.