<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-endpoint-isolation-procedures
description: >-
  Execute network isolation procedures for compromised endpoints during
  incident response. Covers EDR-based isolation, firewall-based quarantine,
  VLAN reassignment, management channel preservation, and controlled
  reconnection after remediation.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - endpoint-isolation
  - containment
  - quarantine
  - incident-response
  - network-segmentation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
    - T1021
    - T1570
    - T1071
---

# Implementing Endpoint Isolation Procedures

## Overview

Endpoint isolation contains compromised systems to prevent lateral movement
while preserving forensic evidence and management access. Multiple isolation
methods exist: EDR network containment (preferred), host-based firewall rules,
VLAN reassignment, and switch port shutdown. The method chosen depends on
urgency, infrastructure capabilities, and evidence preservation needs.

## Prerequisites

| Requirement | Purpose |
|---|---|
| EDR platform | Network containment API (CrowdStrike/MDE/S1) |
| Host-based firewall | Windows Firewall or iptables for local isolation |
| Network infrastructure | Managed switches for VLAN reassignment |
| Management network | Out-of-band or allowed management channels |

## Workflow

1. **Confirm compromise** — Validate indicators before isolating
2. **Preserve evidence** — Capture memory and volatile data before isolation
3. **Select isolation method** — EDR containment (fastest) or firewall/VLAN
4. **Preserve management access** — Whitelist EDR, SIEM, and admin channels
5. **Execute isolation** — Apply containment via chosen method
6. **Verify isolation** — Confirm no network connectivity except management
7. **Perform remediation** — Remove threat while isolated
8. **Controlled reconnection** — Gradually restore network after cleanup and verification

## Key Commands

```powershell
# EDR isolation — CrowdStrike (via API)
# POST /devices/entities/devices-actions/v2?action_name=contain
# Body: {"ids": ["<device_id>"]}

# EDR isolation — Microsoft Defender for Endpoint
# POST /api/machines/{id}/isolate
# Body: {"Comment": "Isolating due to confirmed compromise", "IsolationType": "Full"}

# Windows Firewall — Full isolation with management exceptions
netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
netsh advfirewall firewall add rule name="Allow EDR" dir=out action=allow remoteip=<edr_cloud_ip>
netsh advfirewall firewall add rule name="Allow Management" dir=in action=allow remoteip=<admin_subnet>

# Linux iptables — Full isolation with management exceptions
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A OUTPUT -d <edr_server> -j ACCEPT
iptables -A INPUT -s <admin_subnet> -j ACCEPT
iptables -A OUTPUT -d <siem_server> -p tcp --dport 514 -j ACCEPT

# Verify isolation
ping 8.8.8.8  # should fail
Test-NetConnection -ComputerName <edr_cloud> -Port 443  # should succeed

# VLAN reassignment (Cisco switch)
# interface GigabitEthernet0/1
#   switchport access vlan 999  # quarantine VLAN

# Release from isolation — CrowdStrike
# POST /devices/entities/devices-actions/v2?action_name=lift_containment
```

## Verification

| Check | Method |
|---|---|
| Isolation active | Endpoint cannot reach general network (ping fails) |
| Management preserved | EDR agent maintains heartbeat during isolation |
| SIEM receiving logs | Log forwarding continues through isolation |
| Admin access works | Remote management tools connect via allowed channels |
| Reconnection validated | Post-remediation scan clean before network restoration |

## References

- [CrowdStrike Containment API](https://falcon.crowdstrike.com/documentation/)
- [MDE Machine Isolation](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/isolate-machine)
- [NIST SP 800-61 — Incident Handling Guide](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)

---
v1.0 | Validated: 2026-03-18
