Auto Isolation automatically disconnects an endpoint from the network as soon as Endpoint Detection & Response detects activity it categorizes as critical severity. This severity level is reserved for the highest, most immediate threats, so admins can investigate the threat without worrying it will spread to other endpoints.
This configuration is available for Windows, Linux, and macOS systems. It incorporates options for Networking Isolation and Process Isolation across all supported operating systems, as well as Desktop Isolation specifically for Windows.
Note: This setting also automatically enables a notification for Critical and High Severity Suspicious Activities, even though automatic isolation is only for Critical Severity Suspicious Activities.
If you prefer to isolate endpoints solely by manual process instead of using automatic isolation, auto isolation can be disabled.
- Go to Configure > Policies.
- Select a policy.
- Select Endpoint Detection and Response policy settings.
- Uncheck Allow automatic isolation of endpoints when critical suspicious activity is found for all operating systems.
For more information, see Endpoint Detection and Response policy settings in Nebula.