You can cancel a containment request for a host endpoint at any time.
Once the containment request is canceled, no further containment actions are allowed for the endpoint, until its agent has checked back in with the HX appliance and completed the cancellation task.
Admin, investigator, senior analyst, or analyst access
A containment request is ongoing. See Requesting containment.
Select Hosts in the Endpoint Security (HX) Web UI.
Select the checkbox to the left of a host endpoint for which containment is requested, but not approved.
Select Cancel containment request from the Actions menu.
Click Go.
You can also cancel containment from the host alert details and host details sections of the Hosts page.
Select Hosts in the Endpoint Security (HX) Web UI.
Request host details by clicking on the Expand icon (
.png "ExpandIcon.png")
) associated with a host.At the top of the details page, click Cancel containment request.
After you cancel a containment request for a host, the host's status changes to Stopping containment.
When the cancellation succeeds, all containment icons disappear from beside the hostname. The Contained Hosts area of the Dashboard shows one fewer hosts in the number of hosts requested for containment.
If the cancellation fails for a host, its containment status changes to Containment cancellation failed. The containment cancellation failed icon appears beside the hostname on every page where the host is listed.