Isolation and Containment Techniques
Stop the bleeding before you stitch the wound.
Key takeaways
- Isolation stops active attacker movement; it is the first priority after confirming compromise.
- Containment options range from host isolation to VLAN reassignment to ACL changes.
- Preserve evidence before wiping — forensic artifacts may be needed for legal proceedings.
- Vijilan ThreatRespond can trigger automated isolation via EDR integration.
When a host is confirmed compromised and an attacker is actively using it, every second of delay widens the blast radius. Isolation cuts the attacker's access to the network while preserving the host for forensic analysis.
Knowledge check
Why do SOC analysts prefer network isolation over physically unplugging a compromised machine?