Endpoint isolation: the laptop cut off at 2 a.m.

At 2 a.m., the endpoint tool flags a script running on a laptop and isolates it. The laptop belongs to the on-call engineer, who is in the middle of fixing a production outage. Their VPN drops, their access goes with it, and the outage runs another hour while they work out why.

The detection was a false positive: a script the engineer runs every week. Isolating fast was the right call. Nobody told the engineer, though, and nobody could release the laptop at that hour.

Endpoint containment is the part of security operations that acts on a device. Done well, it stops an attacker in seconds and can be undone just as fast.

What is endpoint isolation?

Endpoint isolation cuts a laptop or server off from the network while keeping its link to the endpoint security tool, so analysts can investigate and release it. A full containment response isolates the device, tells its user and opens a case with the evidence. It gets a person’s approval before touching anything critical.

Where endpoint containment goes wrong

1. The user isn’t told. Their machine stops working, and they call the service desk, which doesn’t know either.
2. Critical devices get the same rule. A production server or an on-call laptop is isolated as quickly as any other device.
3. Nobody owns the release. The laptop stays isolated until someone in security has time to look.
4. The case starts empty. The analyst opens the endpoint console, then the identity provider, then the ticket, to rebuild what happened.
5. The user’s accounts stay active. The device is isolated, but the user’s sessions on other systems keep running.

What it costs

A silent isolation becomes an outage of its own, and engineers start asking for exemptions. A slow release keeps people off their machines for hours. Containment that stops at the device also leaves the account behind it working.

What to fix first

1. Tell the user at the moment of isolation. Say what happened, what to do next and who to contact.
2. Mark the critical devices. Production servers, administrator machines and on-call laptops go to a person for approval first.
3. Give every release an owner and a deadline. The case says who reviews it and by when.
4. Open the case with the evidence attached. Include the detection, the device, its user and recent sign-ins.
5. Check the user’s accounts too. A confirmed compromise on the device starts account takeover response.

The guide to building endpoint alert containment has the prompts for each step.

Where it fits

Containment acts on alerts that alert triage has confirmed. The user’s side belongs to the service desk, so an isolation should open or update their ticket in the IT service desk process.

For every part of security operations, from first alert to shipped fix, see SOC automation.