To contain a host endpoint, you must approve its containment request.
If you request containment of a host endpoint using the API, approval is not required.
Admin or investigator access
A containment request must first be made. See Requesting containment.
Select Manage Hosts in the Endpoint Security (HX) Web UI.
Select the checkbox to the left of a host endpoint for which containment is requested, but not approved.
Select Contain from the Actions menu.
Click Go.
You can also approve containment from the host alert details and host details sections of the Hosts page.
Select Manage Hosts in the Endpoint Security (HX) Web UI.
Request host details by clicking on the Expand icon (
) associated with a host.At the top of the details page, click Contain.
After the containment request is approved, the host endpoint's containment status changes to Containment approved. A containment approved icon (
) appears beside the hostname on every page where the host is listed.
When containment succeeds for the host, its containment status changes to Contained. A contained icon 
appears beside the hostname on every page where the host is listed. The Contained Hosts area of the Dashboard shows an additional host in the number of hosts that are contained.
If containment fails for the host, its containment status changes to Containment failed. The containment failed icon appears beside the hostname on every page where the host is listed. The Contained Hosts area of the Dashboard shows an additional host in the number of hosts for which containment has failed.