Overview
Blumira's endpoint detection and response (EDR) capabilities include the ability to isolate agent devices. When you need to temporarily disconnect a device from your network, such as during a security incident, you can use Blumira Agent to isolate the device until it is safe to reconnect it to the network.
Manual isolation options appear in two areas of the app, as follows:
- Findings Response Actions, which offers additional Blumira Agent EDR and ITDR options
- Blumira Agent Devices page
Reference: To learn about Automated Host Isolation, see Automatically isolating a device with Blumira Agent.
When you isolate an agent device, logs continue to flow to Blumira from the isolated device during the duration of isolation, but the device cannot access your network.
Isolating an agent device from the Devices page
To manually isolate an agent device, do the following:
- Navigate to Blumira Agent > Devices.
- In the devices table, click the row of the device you want to isolate.
- In the options menu, click Device details.
- In the Device details window, select Isolated (Block outgoing network traffic except to Blumira).
- Click Save changes.