EDRF Client version 50.3 provides a unified network isolation workflow across Windows, Linux, and macOS endpoints. Network isolation restricts endpoint communications to contain potential security threats while maintaining administrative connectivity.
When you isolate an endpoint, status updates synchronize across management consoles:
EDR Cloud to Endpoint Security (HX): Quarantining an endpoint in EDR Cloud updates its status to Contained in Endpoint Security (HX).
Endpoint Security (HX) to EDR Cloud: Containing an endpoint in Endpoint Security (HX) updates its status to Quarantined in EDR Cloud.
Isolate an endpoint from the network
Isolate a host from EDR Cloud or Endpoint Security (HX) console:
From EDR Cloud:
Log on to EDR Cloud as an administrator.
On the Menu, select one of the following dashboards:
Monitoring
Investigating
Real-time Search
Select the target host.
Select Device Actions > Quarantine Device.
Select Confirm.
For more information, see Quarantine devices.
From Endpoint Security (HX):
Log on to Endpoint Security (HX) as an administrator.
Go to Hosts > All Hosts.
Select the target host.
On the Actions menu, select Contain.
Select Confirm.
For more information, see Containing host endpoints.
Configure network isolation policies in ePO
Configure containment parameters and permitted communications in ePO.
Log on to the ePO console as an administrator.
Go to Menu > Policy > Policy Catalog.
Select Trellix EDR with Forensics from the Product list.
Select Remediation and open the target Remediation Policy.
Under the Containment Settings section, select Enable password to uncontain the endpoint.
Enter the password to uncontain the endpoint locally.
Configure custom notification text to display in a web browser when a user attempts to access the network on a contained endpoint.
Enter by hand: Enter custom notification text. The browser on the contained endpoint formats and renders this text as a webpage.
URL: Enter the URL to redirect the browser on the contained endpoint.
Application path exclusions: Enter executable process paths to exclude from network isolation, such as VPN clients or SSH binaries.
IP address allow lists: Enter allowed host IP addresses or hostnames to preserve administrative connectivity with management nodes during isolation.
Restore an isolated endpoint
Restore endpoints to the network locally on the endpoint using a containment unlock code from Endpoint Security (HX).
To generate a containment unlock code from Endpoint Security (HX), perform the following steps:
Log on to Endpoint Security (HX) as an administrator.
Go to Hosts.
Select the Expand icon (>) next to the contained endpoint.
On the Host Details page, select Unlock Code.
In the Unlock Code dialog box, copy the alphanumeric unlock code generated for that host.
Provide this unlock code to the local administrator on the affected endpoint.