topic Automate Isolation Endpoint in Cortex XDR Discussions

Automate Isolation Endpoint

SupteIbestsec — Mon, 20 Nov 2023 23:26:56 GMT

Just wondering if there is somewhere in xdr to tell it to isolate an endpoint automatically if we get a critical/high/medium alert or confirmed malware/ransomware alert.

I thought there was something in the profiles to change for active this function.

Re: Automate Isolation Endpoint

aspatil — Thu, 23 Nov 2023 06:49:00 GMT

Hello @SupteIbestsec ,

There is no automated response action for isolation from the XDR console itself and hence we need to leverage APIs via SIEM/SOAR tools/platforms to automate this process.

Hope this helps.

Please mark the response as "Accept as Solution" if it answers your query.

Regards.