Modes
Isolation is applied from the host's response panel, from an alert, or by a playbook. Five modes cover the usual needs:
| Mode | What stays open |
|---|---|
| Full | Only the connection to the gateway. |
| Gateway and DNS | The gateway and DNS resolution, so the host can still be reached and name lookups still work. |
| Allowlist | The gateway plus the addresses and ports you list, for example a patch server. |
| Egress | Inbound blocked, outbound allowed. Useful when the concern is lateral movement into the host. |
| Process | Only the named process is cut off from the network. |
How it holds
- Established connections are torn down when containment is applied, not just new ones.
- Containment holds regardless of DNS changes on the host.
- Containment is a lease renewed by heartbeat. The host stays contained if it loses contact with XenXDR, and the path back to XenXDR always stays open, so you keep control of the host throughout.
- Containment survives reboot. It is re-applied before the network comes up.
- The agent checks containment every few seconds and emits a
containment.tamperedevent if anything changes it. Treat that event as a signal to escalate. - The firewall policy in place before containment is snapshotted and restored on release.
Releasing
Release from the same panel, from the case, or by the playbook that applied it. Release restores the previous firewall state and records who released and why.
Good practice
- If your endpoint protection also manages the host firewall, decide which tool owns it during an incident.
- Test the allowlist mode against your management tooling before you need it.