Network Quarantine an Endpoint

Network quarantine is the mechanism employed by ZeroLock® to isolate infected Linux endpoints from the company network until the malware has been analyzed and remediated.

At times, isolating a computer from the company’s network is necessary to protect the network's integrity. An example is when an endpoint suffers a malware attack. 

There are two (2) ways ZeroLock places an endpoint into network quarantine: Manually or Automatically.

Manually

1. On the ZeroLock Management Console (ZMC) go to Endpoints and select the endpoint to be quarantined. 
   
   
   
2. Next, from the Actions drop-down, select Quarantine Endpoint.
   
    
3. On the Quarantine Endpoints screen one option is to set the amount of time in seconds that the endpoint will be quarantined, or you may leave the timeout field blank so that the endpoint will stay quarantined until manually released.  The #2 refers to the ID number of the endpoint. 
   
4. The purple dot on the Endpoints page and the purple arc on the Endpoints display indicate that an endpoint is under network quarantine.
   
5. Releasing an endpoint from quarantine is a simple matter of selecting the quarantined endpoint and, from the ACTIONS drop-down menu, clicking Unquarantine Endpoint.
   

Automatically

Auto Quarantine is available when ransomware, cryptojacking, tampering alerts, or hash rules are triggered.

1. The setting is enabled on the Configuration Profile assigned to an endpoint.  
   
   
2. On selecting Edit the full configuration profile settings are visible.  Activate Auto-Quarantine by selecting the box for each section.
3. On selecting Update, a confirmation pop-up appears.  Clicking Confirm sets the new configuration.
4. The endpoint will automatically go into quarantine when triggered, in this case by a ransomware attack. The purple dot on the Endpoint and the purple arc in the endpoint display indicate that the endpoint has been quarantined.
   
   
   
5. Even though an endpoint is quarantined, you can still see, connect, and work with the endpoint from the SHELL window on the endpoint detail page.
   
   
   
6. Releasing an endpoint from quarantine is as simple as selecting the endpoint, returning to the Actions drop-down screen, and selecting Unquarantine Endpoint.
    
7. On the Unquarantine Endpoints screen you select the Unquarantine button to release the endpoint.  The #2 refers to the ID number of the endpoint. 
    
   

Congratulations.  You have successfully Quarantined and Unquarantined a ZeroLock Agent endpoint.