Is it possible to automatically isolate a device from the network when an infected file on a device is detected?

Issue:

Is it possible to automatically isolate a device from the network with Elements Endpoint Protection Agent when an infected / malicious file on a device is found?

Resolution:

If a file is detected as malicious by Elements Endpoint Protection's real-time scanning or DeepGuard features, the device cannot be automatically set to be isolated from the network. When real-time scanning or DeepGuard detect a file, the Elements Agent will either Block, Quarantine or Delete the file based on the action on infection setting in the device profile. 

Only if Elements Detection and Response (EDR) detects a medium or higher risk level detection on a device, can it be set to isolate the device from the network. This is done using the Automated actions rule which is an EDR feature. 

To create an Automated actions rule for your devices:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Automated actions page
3. Select the General page
4. Click Add rule
5. Enter a name for the rule
6. Select Rule type as Endpoint
7. Select response as Device isolation
8. Select the organizations the rule applies to (this setting is for partners)
9. Select if the rule should apply to also devices which have been classified as "critical"
10. Select the risk level when the rule should be triggered
11. Select schedule as Continuous
12. Click Add