Agent Foskett Academy • SOC Analyst Academy • Module 7 • Lesson 62 • Incident Response: Containment, Evidence & Escalation

Lesson 62 — Do We Isolate the Device Now?

The endpoint evidence was getting worse.

PowerShell had executed.
A suspicious process had connected externally.
Credential-access behaviour was under investigation.
The same account had appeared on another device.

The analyst's mouse was already hovering over the isolation action.

“We should isolate it now.”

Agent Foskett looked at the hostname.

“Maybe. What does this device actually do?”

Containment is a security decision and an operational decision. The evidence must inform both.

Make the Isolation Decision Back to SOC Analyst Academy

Agent Foskett deciding whether to isolate a compromised endpoint

Contain now — or investigate longer?

Balance active threat, evidence confidence, lateral-movement risk and business impact before isolating an endpoint.

✓ Assess active threat

✓ Understand device criticality

✓ Preserve key evidence

✓ Record the decision

Case briefing

DEVICE: FIN-WS-044 09:06 — Browser launches PowerShell 09:08 — Suspicious script activity 09:11 — External network connection 09:16 — Credential-access behaviour investigated 09:22 — Same user appears on another endpoint 09:27 — Additional suspicious process activity QUESTION: DO WE ISOLATE FIN-WS-044 NOW? OR DO WE KEEP WATCHING TO COLLECT MORE EVIDENCE? THE WRONG DELAY COULD ALLOW THE ATTACK TO SPREAD. THE WRONG CONTAINMENT ACTION COULD CREATE SERIOUS BUSINESS IMPACT.

Investigation objective

Make an evidence-based endpoint isolation decision by evaluating threat activity, confidence, lateral-movement risk, device criticality, evidence-preservation needs and organisational authority.

Investigator's rule

Do not ask only, “Can we isolate it?” Ask, “What happens if we isolate it — and what happens if we do not?”

Stage 1 — define the containment decision

OPTION A: ISOLATE NOW BENEFIT: Reduce network communication Limit attacker movement Interrupt active activity RISK: Business disruption Evidence/state may change Critical service may be affected OPTION B: DELAY ISOLATION BENEFIT: Collect additional evidence Observe attacker behaviour Coordinate business response RISK: Attacker continues operating Lateral movement Credential theft Data access Persistence Further compromise THIS IS A RISK DECISION, NOT A BUTTON-CLICKING DECISION.

Isolation is containment

The purpose is to reduce the endpoint's ability to communicate and participate in the attack while response continues. It does not automatically prove the device is clean or the incident is contained.

Isolation does not end the investigation

Other identities, sessions, endpoints, applications and cloud workloads may remain compromised. Treat device isolation as one response action inside the larger incident.

Stage 2 — determine whether malicious activity is active

1234567891011

DeviceProcessEvents
| where Timestamp > ago(2h)
| where DeviceName =~ "FIN-WS-044"
| project Timestamp,
          DeviceName,
          AccountName,
          FileName,
          ProcessCommandLine,
          InitiatingProcessFileName
| order by Timestamp asc

Active behaviour raises urgency

If suspicious processes are still spawning, commands are executing or new connections continue to appear, every minute of delay may create additional risk.

Historical evidence changes the equation

If the suspicious activity ended hours ago, the immediate containment pressure may be different. That does not mean isolation is unnecessary; it means the decision can incorporate more context.

Stage 3 — examine network activity

123456789101112

DeviceNetworkEvents
| where Timestamp > ago(2h)
| where DeviceName =~ "FIN-WS-044"
| project Timestamp,
          DeviceName,
          InitiatingProcessFileName,
          RemoteIP,
          RemotePort,
          RemoteUrl,
          ActionType
| order by Timestamp asc

Ask what the device can still reach

Connections to internal resources, remote administration services, identity infrastructure or suspicious external destinations can materially change the containment priority.

One external connection is context, not a verdict

Correlate network activity with process ancestry, destination reputation, timing and other evidence. Do not isolate a critical system merely because one IP address looked unfamiliar.

Stage 4 — assess lateral-movement risk

ASK: Were credentials exposed? Did LSASS access occur? Did the user authenticate elsewhere? Did the device connect to other endpoints? Were remote-management tools used? Did new accounts or sessions appear? Was privileged access involved? Is the same indicator present elsewhere? IF THE DEVICE MAY BE A LAUNCH POINT FOR MOVEMENT: THE COST OF WAITING RISES QUICKLY.

Contain the launch point

A workstation with evidence of credential theft and movement toward other systems presents a different risk from an isolated suspicious file that never executed.

Scope in parallel

While the isolation decision is being made, other analysts can search for the same account, IP, process, hash or related activity across the environment.

Stage 5 — identify the device's business role

Device type	Containment consideration
Standard user workstation	Isolation may have limited operational impact.
Executive workstation	Business impact may be visible, but security risk still requires action.
Shared clinical / operational terminal	Loss of connectivity may affect essential operations.
Production server	Isolation could interrupt critical services or dependencies.
Domain / identity infrastructure	Response requires immediate specialist coordination.
Unknown asset	Determine ownership and function quickly; uncertainty itself is relevant.

Business impact does not cancel security risk

A critical device may still need immediate containment. Its importance changes how the response is coordinated, not whether confirmed malicious activity should be ignored.

Know before you click

Asset ownership, service dependencies, criticality and available failover can help responders choose the safest containment path under pressure.

Stage 6 — preserve what matters

BEFORE ISOLATION, WHEN TIME AND PROCEDURE ALLOW: Record device identity Record alert / incident IDs Capture process timeline Capture command lines Capture network evidence Capture logged-on account context Record suspicious files / hashes Record persistence evidence Record related identities Record current scope Record the reason for containment BUT: DO NOT LET PERFECT EVIDENCE COLLECTION BECOME AN EXCUSE TO LEAVE AN ACTIVE ATTACKER CONNECTED.

Preservation and containment compete for time

In a high-confidence active compromise, immediate risk reduction may outweigh collecting every possible artefact first. Follow approved procedures for evidence capture and emergency response.

Document what you could not collect

If urgent isolation prevented additional evidence collection, record that limitation. An explicit evidence gap is better than pretending the evidence never existed.

Stage 7 — weigh confidence against consequence

Evidence	Containment pressure
Single weak anomaly	Investigate further unless other context raises risk.
Suspicious process chain plus external connection	Strong reason to prepare containment.
Confirmed malicious execution	High containment pressure.
Credential access plus lateral movement	Very high containment pressure.
Active destructive behaviour	Emergency containment according to procedure.
Critical production asset with ambiguous evidence	Rapid specialist and business coordination may be required.

Confidence matters

The greater the operational consequence of isolation, the more important it is to understand the evidence supporting the decision — unless immediate destructive risk makes delay unacceptable.

Risk is two-sided

Analysts often focus only on the risk of isolating the device. The risk of not isolating it must be stated just as clearly.

Stage 8 — decide who has authority

SOC ANALYST: Evidence and recommendation INCIDENT LEAD: Response coordination ENDPOINT TEAM: Technical containment / recovery BUSINESS OWNER: Operational impact and priorities SPECIALIST TEAMS: Critical infrastructure / server / identity context ORGANISATIONAL PROCEDURE: Defines who can authorise what THE WORST TIME TO DISCOVER YOUR CONTAINMENT AUTHORITY IS DURING AN ACTIVE INCIDENT.

Know the playbook beforehand

Response procedures should define which endpoints analysts can isolate directly, which require approval and what emergency authority exists when malicious activity is actively causing harm.

Escalate the decision, not just the alert

If approval is required, state the evidence, active risk, business impact and recommended action clearly: “We recommend isolating FIN-WS-044 now because...”

Stage 9 — make the decision

CURRENT EVIDENCE: ✓ Browser → PowerShell chain ✓ Suspicious script execution ✓ External network activity ✓ Credential-access behaviour under investigation ✓ Same identity appears on another endpoint ✓ Additional suspicious processes continue BUSINESS CONTEXT: FIN-WS-044 is a standard finance workstation. No critical production service depends on it. RISK OF ISOLATION: User interruption Investigation state changes RISK OF DELAY: Credential abuse Lateral movement Further execution Additional compromise DECISION: ISOLATE FIN-WS-044 ACCORDING TO APPROVED RESPONSE PROCEDURE.

The decision should be explainable

A reviewer should be able to see why isolation was reasonable based on what was known at the time — even if later evidence changes the final incident conclusion.

Do not judge yesterday's decision with tomorrow's evidence

Incident decisions should be assessed against the information available when they were made. Good documentation preserves that context.

Stage 10 — verify what happened after isolation

DEVICE ISOLATED ↓ VERIFY STATUS ↓ CONTINUE ENDPOINT INVESTIGATION ↓ WATCH RELATED IDENTITIES ↓ CHECK OTHER DEVICES ↓ CHECK CLOUD ACTIVITY ↓ REASSESS SCOPE IMPORTANT: IF SUSPICIOUS ACTIVITY CONTINUES AFTER FIN-WS-044 IS ISOLATED... FIN-WS-044 WAS NOT THE WHOLE INCIDENT.

Containment is something you verify

Confirm the endpoint reached the expected containment state according to your platform and procedures. Do not assume the action succeeded simply because it was requested.

Watch for activity elsewhere

If the same identity, application or attacker infrastructure remains active after device isolation, the incident has additional access paths that must be investigated and contained.

Example containment decision note

DEVICE: FIN-WS-044 DECISION: Endpoint isolation recommended and initiated according to approved incident procedure. RATIONALE: Correlated endpoint evidence includes suspicious PowerShell execution, external network activity and continued process activity. Credential-access behaviour is under investigation and the associated identity has appeared on another endpoint, increasing lateral-movement risk. BUSINESS IMPACT: FIN-WS-044 is a standard user workstation. No critical service dependency identified. EVIDENCE PRESERVED: Process timeline, command-line evidence, network activity, relevant account context and incident IDs. NEXT ACTIONS: Verify isolation state. Continue endpoint investigation. Scope the identity across other devices. Review cloud and identity activity. Reassess containment as new evidence appears.

Lesson 62 key takeaways

Endpoint isolation is a risk decision, not simply a technical action.
Ask what happens if you isolate the device and what happens if you do not.
Active malicious execution increases containment urgency.
Credential access and lateral-movement evidence can sharply increase the cost of delay.
Understand the device's business role and dependencies before containment when circumstances allow.
Business criticality changes coordination requirements; it does not erase security risk.
Preserve important evidence before isolation when doing so does not create unacceptable delay.
Do not allow perfect evidence collection to keep an active attacker connected.
Use organisational procedures and defined authority for containment actions.
Document the evidence, recommendation, decision, business context and timestamp.
Verify that containment actually took effect.
Continue scoping after isolation because the endpoint may be only one part of the incident.

Module 7 — Incident Response: Containment, Evidence & Escalation

Lesson 62 made the endpoint containment decision. Lesson 63 moves to identity containment and asks another deceptively simple question with potentially enormous consequences.

Next: Lesson 63 — Do We Disable the Account?

Continue your SOC Analyst training

Module 3 focuses on identity incidents, authentication, MFA, privilege, sessions and application access.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 7: Incident Response: Containment, Evidence & Escalation

Move from investigation into coordinated containment, evidence preservation, scoping, escalation and recovery.

← Previous lesson

Lesson 61 — The Investigation Became an Incident Recognise the transition from analysis to coordinated response.

✅ Current lesson

Lesson 62 — Do We Isolate the Device Now? Balance containment urgency against business impact and uncertainty.

Next lesson →

Lesson 63 — Do We Disable the Account? Assess identity containment options and consequences.

When should a SOC analyst isolate a compromised device?

Lesson 62 of the Agent Foskett SOC Analyst Academy teaches analysts how to decide whether to isolate a suspicious endpoint by balancing active threat, lateral-movement risk, evidence confidence, business impact and evidence preservation.

Endpoint containment decisions with Microsoft Defender XDR

Learn how to investigate recent process and network activity with Microsoft Defender XDR Advanced Hunting, assess device criticality, document containment decisions, verify isolation and continue incident scoping after containment.