topic Re: AMP Endpoint Isolation in Endpoint Security

AMP Endpoint Isolation

soup_dragon — Fri, 15 May 2020 15:13:19 GMT

Been a user of AMP for sometime but installed and left to do its own thing for quite a while. Been focusing in recent weeks updating connectors and reviewing settings and came across a question couldn't find the answer to and thats how to Isolate a Computer.

In the help text it states

Starting an Endpoint Isolation Session

Isolating an endpoint blocks all network traffic except for communication to the AMP Cloud and any other IP addresses configured in your IP isolation allow list.

To start an Endpoint Isolation session:

1.	In the console, navigate to Management > Computers.

2.	Locate the computer you want to isolate and click to display details.

3.	Click the Start Isolation button.

The Connector UI will indicate that the endpoint is isolated.

I cannot see the Start Button to start isolation, anyone else have the same issue?

Thanks

Re: AMP Endpoint Isolation

Matthew Franks — Fri, 15 May 2020 15:53:47 GMT

You need to be on Windows Connector version 7.0.5 or higher and have isolation enabled in your policy. Then, you should see the Start Isolation button.

Thanks,

Matt

Re: AMP Endpoint Isolation

soup_dragon — Fri, 15 May 2020 17:04:56 GMT

Perfect, in fact I was missing the button but missed it needed to be setup in Policy, help text didn't mention that. Have now switched on for all active polices. Thanks for the quick response.

Re: AMP Endpoint Isolation

Troja007 — Mon, 25 May 2020 11:56:09 GMT

Hello @soup_dragon,

AMP for endpoints also includes automated actions, where you can automate the isolation based on generated IOCs.

Greetings,

Thorsten