{"id":8060,"date":"2026-10-18T11:13:53","date_gmt":"2026-10-18T08:13:53","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=support_article&p=8060"},"modified":"2026-10-18T11:13:53","modified_gmt":"2026-10-18T08:13:53","slug":"is-it-possible-to-automatically-isolate-a-device-from-the-network-when-an-infected-file-on-a-device-is-detected","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/is-it-possible-to-automatically-isolate-a-device-from-the-network-when-an-infected-file-on-a-device-is-detected\/","title":{"rendered":"Is it possible to automatically isolate a device from the network when an infected file on a device is detected?"},"content":{"rendered":"

Issue:<\/h3>\n

Is it possible to automatically isolate a device from the network with Elements Endpoint Protection Agent when an infected \/ malicious file on a device is found?<\/p>\n

Resolution:<\/h3>\n

If a file is detected as malicious by Elements Endpoint Protection's real-time scanning or DeepGuard features, the device cannot be automatically set to be isolated from the network. When real-time scanning or DeepGuard detect a file, the Elements Agent will either Block, Quarantine or Delete the file based on the action on infection setting in the device profile.\u00a0<\/p>\n

Only if Elements Detection and Response (EDR) detects a medium or higher risk level detection on a device, can it be set to isolate the device from the network. This is done using the Automated actions <\/strong>rule which is an EDR feature.\u00a0<\/p>\n

To create an Automated actions rule for your devices:<\/p>\n

    \n
  1. Log in to the Elements Security Center portal<\/li>\n
  2. Navigate to the Security configurations > Automated actions <\/strong>page<\/li>\n
  3. Select the General <\/strong>page<\/li>\n
  4. Click Add rule<\/strong><\/li>\n
  5. Enter a name for the rule<\/li>\n
  6. Select Rule type <\/strong>as Endpoint<\/strong><\/li>\n
  7. Select response as Device isolation<\/strong><\/li>\n
  8. Select the organizations the rule applies to (this setting is for partners)<\/li>\n
  9. Select if the rule should apply to also devices which have been classified as "critical"<\/li>\n
  10. Select the risk leve<\/strong>l when the rule should be triggered<\/li>\n
  11. Select schedule <\/strong>as Continuous<\/strong><\/li>\n
  12. Click Add<\/strong><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    Is it possible to isolate a device from the network with Elements Endpoint Protection Agent when an infected \/ malicious file on a device is found?<\/p>\n","protected":false},"template":"","support_article_product":[100],"class_list":["post-8060","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000006156","source_version":1,"source_system":"salesforce","source_date_updated":"2026-10-18 08:13:53","import_hash":"ed6aa7d4e9cb242c027ce4652e8a05ef22f115e3","vanilla_article_id":"","vanilla_url":"","vanilla_kb_id":"","vanilla_category_id":"","machine_translated":false,"reactions_helpful_yes":"","reactions_helpful_no":""},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/8060","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=8060"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=8060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}