Step-by-step: Isolating a compromised endpoint using the Intercept X console.

The console steps are indeed simple, but your core question about isolation versus containment is the right one to focus on. Think of it as host-level versus object-level response. Containment quarantines a specific file to prevent execution, which is useful for a known malicious payload. Isolation severs all network interfaces at the host level, which you'd use when the system's trust is broken, like during active adversary presence or lateral movement.

The network drop is immediate for all connections, inbound and outbound. It's a hard cut. This is why several posters rightly emphasized pre-isolation dependency checks. If you sever a database server without understanding its connections, your incident becomes a cascading outage. Your runbook should mandate a quick consult of historical network data, not just the Intercept X console, before that right-click.

For the runbook steps themselves, document the exact navigation path: Endpoints view, right-click the compromised host, select "Isolate," confirm the dialog. But place those steps after a decision gate that assesses the scope of compromise. The mechanical action is trivial. The strategic decision to use it is not.

Scheduling drills for minimal user disruption is a smart approach. You've landed on the core tension: we need real-world data on network dependencies, but generating that data creates its own operational risk.

I'm curious about the follow-up after your drills. When you find those 2 AM legacy connections through the logs, how does your team document that for the next time? We tried adding a "dependency learnings" section directly into the incident post-mortem template, so the runbook gets updated before the knowledge fades.

Several of the replies have already covered the console steps clearly: you find the host in the Endpoints view, right-click, and select "Isolate." The network drop happens immediately and completely, which is why the distinction between isolating a machine and containing a file is so critical.

Your runbook should start well before that click, with a step to quickly validate the alert and check network dependency maps. The actual console action is the last step in a sequence of decisions, not the first.

On the communication piece, we found that adding a script for the help desk to call the user right after isolation, before they notice the network loss, dramatically reduces panic reboots. It turns a confusing outage into a coordinated action.

Everyone's given you the console clicks, which are trivial. You've got the right question about the network drop - yes, it's immediate and total. The machine is off the network, full stop.

The real step-by-step for your runbook starts hours or days before the alert, building that dependency map others mentioned. The 'Isolate' button is just the ceremonial button-press after you've already decided to burn the bridge. If you're writing the runbook starting at the console, you're documenting the fireworks show and ignoring the arson investigation.

Yeah, that "quick consult of historical network data" step is really sticking with me. How do you actually do that under pressure? I mean, is it just having a live netflow dashboard open, or are you pulling up specific connection logs from something like Zeek *while* the alert is on screen?

It sounds like that's the real step one, even before the console, but my team's runbook doesn't have that documented yet. We just have "verify the threat."

Several replies already walked you through the console clicks, which is the easy part. The immediate network drop is total, all sessions severed.

Your real question about isolating a machine vs containing a file is the key. Isolation is for a breached host, containment is for a known bad object. If you're writing a runbook that starts with the console steps, you're documenting the emergency brake but not the decision to pull it. The step before the click is checking your real-time netflow to see what you're about to disconnect.

Panic reboots are the least of your problems. If your help desk is calling users post-isolation, you're already failing.

That call should come from the security team running the incident, before the isolation click. If your user hears it from generic IT support after their network vanishes, they'll assume a random outage and try to fix it themselves. The coordination has to be part of the pre-click checklist, not a reactive script.

Excellent question, because focusing just on the console steps is a common pitfall when you're new to it. The physical steps are straightforward, but the decision to use them is the real meat of your runbook.

Right-click and isolate in the console *will* drop all sessions instantly. It's a hard stop. The key difference is intent: containment is for a single suspicious file, like putting it in a box. Isolation is for the whole system when you believe the threat is active inside it. Your runbook's first step shouldn't be "open the console," it should be "determine if this is a file problem or a host problem."

Since you're building this for a team, I'd suggest adding a quick checklist *before* the console step that forces that decision. Something like:
- Is this a known, isolated malware file?
- Or are we seeing behavior that suggests the host itself is compromised?

If it's the second one, that's your trigger to check dependencies and then hit isolate.

Exactly, that pre-click dependency check is the only real "step" that matters. I've seen teams build beautiful runbooks around the console action, but they fail because that map of silent connections doesn't exist in a crisis-usable form.

Your point about consulting *historical* netflow is spot on. Real-time dashboards show you what's happening *now*, but you need to know about that nightly backup job or the 3 AM log pull from a legacy app. We started tagging critical dependencies directly in our asset inventory with a "pre-isolation check" flag, so the on-call person isn't parsing raw flow data under pressure. It turns a 10-minute investigation into a 30-second verification.

Your core question about the console steps is the wrong starting point. The mechanical process is trivial - right-click the host, select "Isolate". The network drop is instantaneous and total.

The critical step for your runbook is the decision gate before you ever open the console. You need a clear flowchart: if the threat is an identified file, you contain it; if the host itself is believed compromised, you isolate. Most teams get this wrong on the first real alert because the runbook focuses on the button click, not the triage logic.

Your runbook's first step should be "Confirm host-level compromise," not "Log into the Intercept X console."

You've hit on the crucial gap in most documentation. The phrase "mapped list of that machine's critical dependencies" is the operational key, but I've found static lists decay rapidly.

We implemented a validation step that runs a quick query against a week of aggregated Zeek data *at the moment of triage*. The script pulls the top 5 unique destination IPs and ports by connection count for the suspect host. It's not perfect historical context, but it surfaces active dependencies like an unmonitored SFTP server that a static inventory missed. This turns an abstract "check the map" into an actionable, repeatable data pull that lives in the runbook itself.

The silent, severed connections you mentioned are exactly what this catches, because it's showing you the established conversations, not just permitted firewall rules.

The console clicks are easy: find the host, right-click, select "Isolate". Yes, it drops all network sessions immediately, like pulling the Ethernet cable.

But focusing your runbook on that button press is a mistake. The real steps are before the console: confirming it's a host-level breach, not just a bad file, and checking what critical connections you're about to sever. Your runbook's first step should be a triage checklist, not opening the admin panel.

Totally get why you'd want the exact console steps, especially when you're building a runbook for a team. The right-click and isolate process is simple, but like others have said, that click should come after a clear decision point.

On your question about network connections, yes, it's an immediate and total drop. Think of it as a hard network quarantine, so any live sessions, from the user's VPN to a database connection, are cut instantly. That's exactly why several folks here are emphasizing a quick dependency check right before you click. You don't want to accidentally sever a critical business process without knowing it.

The file containment vs. host isolation distinction is crucial for your runbook logic. Containment is for that one suspicious file you've identified. Isolation is for when you believe the machine itself is actively compromised. I'd structure your document so the first section is a triage checklist to force that decision, and *then* you get to the console actions.