Isolate Endpoint Task
You can take preventive isolation measures on compromised endpoints that may pose a security risk to your network using context menus on the Trend Vision One console.
-
After identifying the endpoint to isolate, access the context or response menu
and click Isolate Endpoint.
The Isolate Endpoint Task screen appears.
- Confirm the targets of the response.
- (Optional) Specify a Description for the response or event.
-
Click Create.
Trend Vision One creates the task and displays the current command status on the Response Management app.
-
Monitor the task status.
- Open the Response Management app.
- (Optional) Locate the task using the Search field or by selecting Isolate Endpoint from the Action drop-down list.
-
View the task status.
-
Pending approval (
) (if applicable): The automated response task
was created on the Workbench app and is waiting for
approval -
Rejected (
) (if applicable): The automated response task
created on the Workbench app was rejected -
In progress... (
): Trend Vision One sent the command
to the managing server and is waiting for a response -
Queued (
): The managing server queued the command
because the Security Agent was offline -
Successful (
): The managing server successfully received
the command -
Unsuccessful (
): An error or time-out
occurred when attempting to send the command to the managing server, the Security
Agent is offline for more than 24 hours, or the command execution timed out
Important:The Task status indicates whether the managing server was able to successfully receive and execute the command. If the command target is a Security Agent, the Task status does not necessarily indicate whether the target Security Agent or object successfully executed the command.
-
After resolving the security issue on the isolated endpoint, you can restore network connectivity using the options button (
) in the Response Management app.For more information, see Restore Connection Task.
