Network isolation cuts a compromised device off from the rest of your environment while keeping the Defend agent channel open so you can continue taking action. It is the fastest way to stop lateral movement during an active attack. Isolation can be triggered in seconds from an alert, a device detail page, or a SOAR playbook.
What Isolation Blocks
When you isolate a device, the agent instructs the endpoint to block all network traffic with one exception: the agent's communication channel back to Defend remains open. This means:
- The user cannot browse the internet.
- The device cannot reach file shares, printers, or other network resources.
- Outbound connections from any process — including any active malware — are blocked.
- Inbound connections are blocked.
- The Defend console can still send and receive commands from the device (kill process, collect forensics, release).
Isolating a Device
From an Alert
- Open the alert in the Alerts view.
- Click Isolate Device in the response actions panel.
- Confirm the action.
Isolation takes effect within seconds on an online device.
From the Device Detail Page
- Go to Devices and open the device.
- Click Isolate.
- Confirm the action.
After Isolation
Once isolated, the device detail page shows an Isolated status badge. Any response actions — kill a process, collect forensics, run a playbook — remain available while the device is isolated because the agent channel is still active.
Use the investigation tools (process tree, file context, network context) to complete your analysis while the device is contained. Threat hunt is listed in the console but is retired on this arm — it answers hunt_store_retired rather than running a query.
Releasing from Isolation
Before releasing a device, confirm that:
- The threat has been remediated (malicious processes killed, files quarantined or removed).
- Any persistence mechanisms identified in the investigation have been addressed.
- You are satisfied that the device is clean or have accepted the residual risk.
To release:
- Open the device in the Devices view.
- Click Release from Isolation.
- Add a note explaining why the device is being released and what remediation was done.
The note is recorded in the audit log for the device.
Troubleshooting
Isolate command did not take effect. The device must be online when the isolation command is issued. If the device is online and isolation still fails, check the command status on the device page for an error. In rare cases the endpoint firewall has already been disabled by an attacker before you issued the isolation command.
Device went offline before isolation completed. The isolation command is queued. When the device comes back online and checks in, the command will be delivered and executed.
Response action returns "replay rejected" after isolation. Command signing prevents replay attacks. If the same command blob was already completed, issue a fresh command from the console rather than retrying the original action.
FAQ
Can a user reverse the isolation from the endpoint? No. Tamper protection is active. The user cannot remove or reconfigure the agent, and they cannot undo isolation from the device itself.
Does isolation affect other devices on the same network? No. Isolation is per-device. Only the isolated device loses network access. Other devices on the same LAN segment continue operating normally.
Can I isolate a device automatically when a critical detection fires? Not by default. Automatic isolation is built — you configure a SOAR playbook with an isolate step and wire it to a detection rule — but automated response is off until it is deliberately enabled for your environment. Until then a critical detection raises an alert and someone isolates the device from the alert or the device page, which takes seconds. Ask us before relying on hands-off isolation.