https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/isolate-endpoints-automatically/m-p/516461#M2927 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/211922">@KarlHalpin</a>&nbsp;,</P> <P>&nbsp;</P> <P>There is no automated response action for isolation from the XDR console itself and hence we need to leverage APIs via SIEM/SOAR tools/platforms to automate this process.</P> <P>&nbsp;</P> <P>Regards.</P> Fri, 30 Sep 2022 10:44:01 GMT neelrohit 2022-09-30T10:44:01Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/isolate-endpoints-automatically/m-p/516460#M2926 <P>Hi Guys,</P> <P>&nbsp;</P> <P>Just wondering if there is somewhere in xdr to tell it to isolate an endpoint automatically if we get a critical alert or confirmed malware/ransomware alert.</P> <P>&nbsp;</P> <P>I thought there was something in the profiles but cant seem to find it or is this only possible with a soar platform?</P> Fri, 30 Sep 2022 10:19:18 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/isolate-endpoints-automatically/m-p/516460#M2926 KarlHalpin 2022-09-30T10:19:18Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/isolate-endpoints-automatically/m-p/516461#M2927 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/211922">@KarlHalpin</a>&nbsp;,</P> <P>&nbsp;</P> <P>There is no automated response action for isolation from the XDR console itself and hence we need to leverage APIs via SIEM/SOAR tools/platforms to automate this process.</P> <P>&nbsp;</P> <P>Regards.</P> Fri, 30 Sep 2022 10:44:01 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/isolate-endpoints-automatically/m-p/516461#M2927 neelrohit 2022-09-30T10:44:01Z