Remote Shell: Investigate and resolve without leaving the detection page

Remote Shell is now available in Iru EDR. Open a remote connection to a managed Mac straight from a detection: investigate the threat, stop malicious processes, and pull forensic files back into the console. It keeps working even while the affected Mac is under device isolation.

A detection fires on a MacBook in finance: an unknown process is connecting to an external address. You isolate the device in under a minute. Now you need to find out what that process is, and this is usually where things slow down.

The detection already gives you the context: what fired, where, and the device’s current state. Once you open a shell, though, you lose that context and have to rebuild it by hand, switching back to the alert, checking the device record, and re-running commands. And because you’ve isolated the device, your usual remote access tool probably can’t reach it. You shouldn’t have to pick between containing the threat and investigating it.

Remote Shell fixes this by putting the terminal inside the investigation instead of next to it.

Connect directly to the affected device from inside the detection window

While viewing a detection, admins can click Launch Remote Shell, and Iru opens a secure tunnel to the device. The terminal comes up beside the detection and the device details, so what raised the question stays in front of you while you answer it. You can read what fired, check the device’s posture, and run the commands to confirm or rule it out without pivoting between tabs.

Stay connected to isolated devices

Iru offers two levels of device isolation. Partial isolation cuts the device off from the network but keeps Iru’s control channel open, so Remote Shell stays reachable and you can contain first and investigate second. Complete isolation blocks everything, including the shell, so choose partial when you expect to investigate.

Getting started

Remote Shell is included in Iru EDR, and it’s also available as an add-on for customers running Iru Endpoint Management without the EDR package. It’s available on macOS at launch, with Windows to follow.

Ready to set it up? Read the Remote Shell documentation.

Not on Iru EDR yet? Book a demo to see it in action.