Endpoint Isolation.

An EDR response action that severs a compromised host's network connectivity except to the security tooling, so attackers cannot move laterally while responders investigate. It belongs to the Defense & Operations category of cybersecurity.

An EDR response action that severs a compromised host's network connectivity except to the security tooling, so attackers cannot move laterally while responders investigate.

Endpoint isolation — also called network containment, host quarantine, or host isolation — is a one-click response action exposed by modern EDR platforms (CrowdStrike Real Time Response, Microsoft Defender for Endpoint 'Isolate device', SentinelOne Network Isolation, Carbon Black Cb Live Response, Cortex XDR) that forces the kernel agent to drop or block all network traffic from the endpoint except to the management plane. This stops command-and-control beacons, ransomware encryption of file shares, and lateral movement immediately, giving the SOC time to investigate, collect forensic artefacts and remediate. Best practice ties isolation to playbooks in SOAR tools (Tines, XSOAR, Splunk SOAR), requires dual approval for production servers, and tests release procedures regularly so isolated machines can be safely returned to the network.

Defences for Endpoint Isolation typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Network containment, Host isolation, Host quarantine.