ACTIVE THREAT RESPONSE WITH HOST ISOLATION

原文（中国語）

A method for responding to a threat with host isolation includes receiving, by one or more processors of a threat management computer system, endpoint health information for a plurality of endpoints of a monitored network system managed by the threat management computer system, identifying a threat associated with the monitored network system, identifying a known device identifier or user identification associated with an endpoint of the plurality of endpoints that is responsible for the threat and propagating a global isolation of the endpoint across network devices of the monitored network system. The global isolation is configured to block the device identifier or user identification associated with the endpoint that is responsible for the threat.