Modes
Isolation is applied from the host's page under Response (an alert's event graph links straight there) or by a playbook. Five modes cover the usual needs:
| Mode | What stays open |
|---|---|
| Full | Only the connection to XenXDR. The default. |
| Gateway and DNS | XenXDR and the host's DNS resolvers, so name lookups keep working. Weaker than Full, because DNS can carry data. |
| Allowlist | XenXDR plus the addresses and ports you list, for example a domain controller or a jump box. Addresses and CIDRs only, not hostnames. |
| Egress | The internal network stays reachable; the internet is blocked. For suspected exfiltration on a machine that must keep working. |
| Process | Only the named executables are cut off from the network. Windows only. |
Every isolation needs a reason, which is recorded in the audit log.
Duration
Choose how long isolation lasts when you apply it: until released, or for 1, 8, 24 or 72 hours. Never expire is also available, but a host isolated that way needs manual recovery if it can no longer reach XenXDR.
How it holds
- Established connections are torn down when containment is applied, not just new ones.
- Containment survives reboot. It is re-applied before the network comes up.
- The agent checks containment every 15 seconds. If anything changes it, the agent restores it and emits a
containment.tamperedevent. Treat that event as a signal to escalate. - The firewall policy in place before containment is saved and restored on release.
- If the host loses contact with XenXDR, containment holds for 24 hours, then relaxes to Gateway and DNS, and lifts after 72 hours without contact. A host is never stranded.
Releasing
Release from the host's page under Response, or with a playbook's release action. Release restores the previous firewall state and records who released it and why.
Good practice
- If your endpoint protection also manages the host firewall, decide which tool owns it during an incident.
- Test the allowlist mode against your management tooling before you need it.
- Tell users what isolation means for them. See the isolation notice under Settings › Organizations.