During an investigation, you can quarantine endpoint to disconnect it from the network. Endpoint isolation helps to contain a threat from spreading further in the network. The quarantined or isolated endpoint can't connect with any other endpoints in the network. However, the endpoint can still communicate with all Trellix products to enable further investigation of the threat. Once the threat is mitigated or remediated, you can restore the endpoint back to the network by ending the quarantine.
Important
Make sure Enable Plug-in is selected on the Network Flow policy page for quarantine and end quarantine to work on the endpoint.
If the selected endpoint for quarantine is offline, the quarantine is imposed when the endpoint is back online. You can continue to run real-time or historical searches on this endpoint with EDRF to investigate the potential threat.
Important
Run the HostInfo query on Real-time Search to list endpoints and their connectivity status (online or offline).
On the Monitoring dashboard, you can see a biohazard icon to the left of the endpoint name indicates that it is quarantined.
Enable Display Message on Quarantine actions on the Network Flow policy page to send a notification to the user. A message notifies the user of the quarantine or end quarantine action and the quarantine is maintained between rebooting and shutting down of the endpoint. The notification message is set by default but can be customized.
If the endpoint is not in Enterprise environment and is connected through VPN, it is essential to retain the VPN service when quarantining the endpoint to continue connected with Trellix products. For details about excluding an application or service from quarantine, see Protection policy..
Important
Exclude the network connectivity services (for example, VPN service) before quarantining or isolating the endpoint so the endpoint can be accessed.
You can exclude other applications or services from quarantine before or after quarantining the endpoint.
You can use the following methods to quarantine devices remotely: