Elements EDR automated actions feature did not isolate device from the network

Issue:

We have a device isolation rule created with the automated actions feature for Elements Endpoint Detection and Response (EDR) that should isolate the device from the network, but after a Broad Context Detection (BCD) occurred on a device, either:

• The automated actions device isolation rule did not trigger at all
• Device protection status is shown as "isolated from network" in the Elements Security Center portal but device is still able to access the local network resources and / or some parts of the internet

Resolution:

If the automated action isolate device rule did not trigger at all and the device status is not shown as "isolated from the network", you need to make sure that the risk level (severity) of the Broad Context Detection (BCD) was high enough to trigger the automated actions device isolation rule. 

To view the Broad Context Detection risk level:

1. Log in to the Elements Security Center portal
2. Navigate to the Events > Broad Context Detections page
3. View the risk level from the Risk column

To view which risk level triggers the Automated actions device isolation rule:

1. Log in to the Elements Security Center
2. Navigate to the Security Configurations > Automated actions page
3. Click on the rule which has the response "Device isolation"
4. View the risk level from the Risk level field

If for example the Broad Context Detection risk level (severity) was Medium or High, and the automated actions device isolation rule was set to trigger only to Severe risk level detections, you need to edit the rule. 

If the automated actions device isolation rule has triggered but the device is still able to access the local network resources and / or some parts of the internet, you need to make sure that you do not have any firewall rules created by Group Policy Object (GPO). 

The WithSecure network isolation feature is based on the Windows Firewall functionality. While this approach has its own merits, it also has a lot of limitations, including inability to override any GPO firewall rules.

If you do not have GPO rules, make sure that you have not created too open Network isolation rules in the Elements profile. The Network isolation rules are taken into use then device isolation is triggered. 

1. Log in to the Elements Security Center
2. Navigate to the Security configurations > Profiles page
3. Open the profile that is in use on the device
4. Go to the Firewall settings page
5. Scroll down to the Network isolation section
6. Check the current Firewall rules for WithSecure profile: Network isolation and then the Allowed domains settings to make sure that they do not give too wide access for the device when it has been isolated from the network