Automate Isolation Endpoint

[SupteIbestsec]

Just wondering if there is somewhere in xdr to tell it to isolate an endpoint automatically if we get a critical/high/medium alert or confirmed malware/ransomware alert.

I thought there was something in the profiles to change for active this function.

[aspatil]

Hello @SupteIbestsec ,

There is no automated response action for isolation from the XDR console itself and hence we need to leverage APIs via SIEM/SOAR tools/platforms to automate this process.

Hope this helps.

Please mark the response as "Accept as Solution" if it answers your query.

Regards.