Active response vs Monitor & alert: choosing a mode

The workspace default applies to every protected device; any device can override it.

1. 1Active response (recommended): the engine blocks and quarantines automatically, and every response tool is armed. Set it on Policies.
2. 2Monitor & alert only: everything is detected, triaged, and alerted — nothing is touched automatically. Use for fragile servers and change-controlled fleets.
3. 3Per-device override: on Devices, each protected machine's Mode dropdown can pin Active or Monitor regardless of the default, or follow the default.
4. 4Mode changes reach devices on their next check-in (within the hour).

Tip: A common pattern: workspace default Active, with database and legacy servers pinned to Monitor.