Skip to main content

TARGET: Host

info
RequirementsLimitationsConsiderations
Endgame installed on the target hostOnly one host can be targeted at a timeIPs/Networks (such as NAC servers) that isolated hosts need to communicate with should be added under Administration -> Platform
The hostname of the target host

TACTIC: Isolate Host​

Releasing Hosts From Isolation

The procedures for releasing a host from isolation are the same for placing it in isolation - the Isolate Host response action will instead be replaced with a Release Host response action.

Isolated hosts will appear on the Endpoint Details page with a status of (Isolated) - inversely, hosts that were previously isolated will have a status of (Released).

1 - Target the host​

  1. From the Endgame web UI, navigate to the Endpoints tab on the left-hand pane

  2. Find the hostname of interest and click on the respective ENDPOINT NAME to get to the Endpoint Details page

2 - Isolate the host​

  1. Click on Take Action -> Respond

  2. Click on the Isolate Host radio button

  3. Click on Create Response

  4. Verify that the Responses successfully launched message appears and click Close

3 - Verify the response results​

  1. Wait for the Activity Timeline under the Endpoint Details on the left-hand pane to update with a REFRESH LIST notification

  2. Click on the REFRESH LIST notification

  3. Verify that the newest Host Isolated response entry under the Activity Timeline says Host Isolated (Success)

NOTE: If the entry says Host Isolated (Failed), click on the entry to expand the log message to investigate why the response failed