{"id":9076,"date":"2026-10-23T19:00:25","date_gmt":"2026-10-23T16:00:25","guid":{"rendered":"https:\/\/support.withsecure.com\/support-articles\/can-specific-devices-be-excluded-from-being-isolated-automatically-by-the-edr-automated-actions-rule\/"},"modified":"2026-10-23T19:00:25","modified_gmt":"2026-10-23T16:00:25","slug":"can-specific-devices-be-excluded-from-being-isolated-automatically-by-the-edr-automated-actions-rule","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/can-specific-devices-be-excluded-from-being-isolated-automatically-by-the-edr-automated-actions-rule\/","title":{"rendered":"Can specific devices be excluded from being isolated automatically by the EDR Automated actions rule?"},"content":{"rendered":"

Issue:<\/h3>\n

We have set up the Endpoint Detection and Response (EDR) Automated actions rule so that it automatically isolated devices from the network which have a received a Broad Context Detection that matches a specific risk level threshold.<\/p>\n

We don't want for example our critical servers to ever be automatically isolated from the network. Can specific devices be excluded from being isolated automatically by the EDR Automated actions rule? \u00a0<\/p>\n

Resolution:<\/h3>\n

Yes, specific devices can be excluded so that the EDR Automated actions device isolation rule doesn't isolate them from the network. The Automated actions rule can be set to only apply to non-critical devices:<\/p>\n

    \n
  1. Log in to the Elements Security Center portal<\/li>\n
  2. Navigate to the Security configurations > Automated actions <\/strong>page<\/li>\n
  3. Click on the automated actions rule<\/li>\n
  4. Click Edit <\/strong>from the bottom of the page<\/li>\n
  5. from the Applies to <\/strong>section, tick only Non-critical devices <\/strong>and leave the Critical devices <\/strong>option unticked<\/li>\n
  6. Click Save<\/strong><\/li>\n<\/ol>\n

    Now you can assign the Critical importance <\/strong>to the devices which you do not want to have automatically isolated by the automated actions feature:<\/p>\n

      \n
    1. Navigate to the Environment > Devices <\/strong>page<\/li>\n
    2. Select the devices from the list<\/li>\n
    3. Click Update importance\u00a0<\/strong><\/li>\n
    4. Select Critical<\/strong><\/li>\n
    5. Click Update<\/strong><\/li>\n<\/ol>\n

      \u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

      We have set up the Endpoint Detection and Response (EDR) Automated actions rule so that it automatically isolated devices from the network which have a received a Broad Context Detection that matches a specific risk level threshold.<\/p>\n

      We don’t want for example our critical servers to ever be automatically isolated from the network. Can specific devices be excluded from being isolated automatically by the EDR Automated actions rule? \u00a0<\/p>\n","protected":false},"template":"","support_article_product":[100],"class_list":["post-9076","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000008824","source_version":1,"source_system":"salesforce","source_date_updated":"2026-10-23 16:00:25","import_hash":"486693a5378b37a0525bc0a802ed08ee7f20b341","vanilla_article_id":"","vanilla_url":"","vanilla_kb_id":"","vanilla_category_id":"","machine_translated":false,"reactions_helpful_yes":"","reactions_helpful_no":""},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/9076","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=9076"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=9076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}