Endpoints
      Back to home
      1. Vali Cyber Knowledge Base
      2. ZeroLock®
      3. Endpoints

      Network Quarantine an Endpoint

      Network quarantine is the mechanism employed by ZeroLock® to isolate infected Linux endpoints from the company network until the malware has been analyzed and remediated.

        At times, it becomes necessary to isolate a computer from the company’s network to protect the integrity of the network. A situation where this becomes necessary is when an endpoint suffers a malware attack. 

         

        NOTE: Quarantining is only available for Linux-based systems not for ESXi host systems.

         

        There are two (2) ways ZeroLock places an endpoint into network quarantine: Manually or Automatically.

        Manually

        1. On the ZeroLock Management Console (ZMC) go to Endpoints and select the endpoint to be quarantined. 
          Step_1_Endpoint Selected-1

        2. Next, from the Actions drop-down, select Quarantine Endpoint.
          Step_2_Actions Menu-1
           
        3. On the Quarantine Endpoints screen one option is to set the amount of time in seconds that the endpoint will be quarantined, or you may leave the timeout field blank so that the endpoint will stay quarantined until manually released.  The #4 refers to the ID number of the endpoint. 
          Step_3_Quarantine Box
        4. You can tell an endpoint is under network quarantine by the purple dot on the Endpoints page and the purple arc in the endpoints display.
          Step_4_Quarantined

        Automatically

        Auto Quarantine is based on ransomware, crypto-jacking, or tampering alerts being triggered.
        1. The setting is enabled on the Configuration Profile assigned to an endpoint.  Step_5_Profile Selected

        2. On selecting Edit the full configuration profile settings are visible.  Activate Auto-Quarantine by selecting the box for each section.Step_6_Auto_Quarantine Checkbox
        3. On selecting Update a confirmation pop-up appears.  Clicking Confirm sets the new configuration.Step_7_Warning
        4. You can tell an endpoint is under network quarantine by the purple dot on the Endpoints page and the purple arc in the endpoints display.
          Step_4_Quarantined-1

        5. Even though an endpoint is quarantined, you can still see, connect, and work with the endpoint from the SHELL window on the endpoint detail page.
          Step_8_SHELL_Auto_Quarantined

        6. Releasing an endpoint from quarantine is as simple as selecting the endpoint, returning to the Actions drop-down screen, and selecting Unquarantine Endpoint.
          Step_9_Unquarantine_1 
        7. On the Unquarantine Endpoints screen you select the Unquarantine button to release the endpoint.  The #4 refers to the ID number of the endpoint. 
           
          Step_10_Confirm Unquarantine

        Step_8_Unquarantined Endpoint

        Congratulations.  You have successfully Quarantined and Unquarantined a ZeroLock Agent endpoint.