The containment feature can be a powerful weapon in your enterprise’s security arsenal. You can turn the Endpoint Security (HX) containment feature on and off using the Endpoint Security (HX) Web UI or the CLI. By default, the containment feature is turned on.
Note
You cannot turn containment on or off when containment is disabled (DISABLED appears in the Web UI). You must first enable containment using the CLI. See Blocking and unblocking access to containment.
Endpoint Detection and Response with Forensics (EDRF) > Manage your workspaces > Configure Forensics workspace > Configuring containment > Turning containment on and off
Endpoint Detection and Response with Forensics (EDRF) > Manage your workspaces > Configure Forensics workspace > Configuring containment > Turning containment on and off