After analyzing a broad context detection, you may want to isolate hosts from the network connections to avoid further harm to the environment.
In order to isolate hosts, you must configure Windows group policies to allow F-Secure to control Windows Firewall.
Note: Using the portal to isolate hosts works only with PSB + F-Secure Elements EDR for Computers and F-Secure Elements EDR for Computers standalone installations. If you are using Client Security, use Policy Manager to isolate hosts.
To isolate hosts:
-
- Log in to the portal with your email address and password.
The Home view opens.
-
- In the Top broad context detections pane, select the detection that includes the hosts that you want to isolate.
- Select Recommended actions.
The list of recommended actions opens.
-
- Select Isolate hosts and then Confirm isolation.
Users of isolated hosts receive a message that their computer has been isolated to protect the network.
When a host is isolated, Windows Firewall allows only administrators to undo the isolation and blocks every other network traffic. All potential attackers are disconnected from the host.