EN: Isolating a Computer: Network Quarantine for I...

jorgeluiznim

Article 7 of the Harmony Endpoint Deep Dives series · A note on management: Harmony Endpoint is cloud-managed (Infinity Portal / Web Management) in most deployments today. The content below follows the cloud model — Push Operations run from Asset Management > Push Operations. Where an on-premises Management Server behaves differently, that is called out.

Purpose

A device is compromised and the malware wants to spread. This article covers the fastest containment move in Harmony Endpoint — the Isolate Computer push operation: what it does, what it requires, the companion operations that complete the IR cycle (analyze, remediate, release), how the cloud console schedules and expires the operation, and the automatic Machine Quarantine that does the same thing without a human.

Audience

[x] SOC Analysts
[x] Security Engineers
[x] Endpoint Administrators
[x] Beginners
[ ] Experts

Prerequisites

Firewall component installed on the clients (hard requirement for isolation)
Anatomy of a Forensics Report (Article 4) — the investigation side of this workflow

Overview: Push Operations in 30 Seconds

Push operations are actions the server pushes to clients without installing policy. In the cloud console they live under Asset Management > Push Operations, which by default shows every operation created in the last 30 days (switch to last 7 days or last day). Two lifecycle facts every operator must know:

You choose when it runs (Immediately or Schedule) and when it expires (7 days, 30 days, or Custom). A client that never responds before expiry leaves the operation Partially completed — you then Run Again.
Each operation carries a per-device status: Scheduled, In progress, Partially completed, Completed, Failed. From the table you can Run Again, Clone, Cancel, Delete or Export.

Isolate Computer: What It Actually Does

"Isolates a specific device under malware attack that risks propagation."

When you isolate a device, the endpoint Firewall blocks the device's traffic while keeping it manageable — the flows that survive are the ones that let you keep control and keep the device on the network lease:

Allowed during isolation	Why
DHCP	The device keeps its network lease
DNS	Name resolution keeps working
Management traffic	You keep control: policies, push operations, logs, release

Everything else — lateral movement, C&C callbacks, file shares, user browsing — is blocked.

Key facts:

Requires the Firewall component installed on the client — no Firewall blade, no isolation
Can be applied to one or more devices at once (Entire organization or Custom)
OS support: Windows ✔ · macOS ✔ · Linux ✘
The reverse operation is Release Computer
Verify the state anytime in Asset Management > Organization > Computers — from the View list select Host Isolation and read the Isolation Status column

Manual vs Automatic isolation

Isolation has an automatic twin: Machine Quarantine, one of the responses in Automatic Threat Analysis (the Forensics policy). When a trigger fires with sufficient confidence, the Firewall restricts the computer's network access — no human in the loop. The push operation gives your SOC the same power on demand.

The Containment Playbook (with companion push operations)

Phase	Push operation	Notes
1. Contain	Isolate Computer	Requires Firewall component; Win/macOS
2. Investigate	Analyze by Indicator	Triggers Forensics collection by URL, IP, path, file name, or MD5 (Win/macOS)
	Collect Client Logs	CPInfo logs; upload to Check Point or a corporate server
3. Neutralize	Kill Process	Stop the malicious process
	File Remediation	Quarantine by full file path, Incident ID, or MD5 hash (or restore from quarantine)
	Scan for Malware	Full Anti-Malware scan (Win/macOS/Linux)
4. Recover	Restore Files from Quarantine	Enter the pre-quarantine full path (e.g., `c:\temp\eicar.txt`)
5. Release	Release Computer	Restores connectivity

File Remediation detail — when quarantining by incident: the Incident ID comes from the Endpoint Security client, or the incident UID from the log entry (open the log and expand the details in the Logs view).

ℹ️ Note: the Create-operation flow shows a 2FA Required indicator per operation. Sensitive actions such as Uninstall Client are gated behind Two-Factor Authentication; Isolate and Release are not — containment stays fast. See Push Operations Deep Dive (Article 29) for the full catalog.

Step by Step: Isolating a Device

Go to Asset Management > Push Operations and click Create operation
In the Operation tab, select Forensics and Remediation > Isolate Computer > Next
In the Devices tab, choose Entire organization or Custom (pick the affected devices) > Next
Configure the operation settings and an optional comment > Next
In the Schedule tab, choose Immediately (or Schedule a date/time) and the Expire on window (7 / 30 / Custom) > Next
Review the Summary > Create
Track execution in the Push Operations table and dashboard widgets
After remediation, repeat with Release Computer (also from Push Operations, or from the Computers view)

⚠️ Warning: if the client never responds (offline, powered off) before the Expire on window, the operation ends Partially completed — Run Again when the device comes back.

Best Practices

✅ Best Practice: make the Firewall component part of your standard client package — an IR capability you install during the incident is not a capability.

✅ Best Practice: pre-authorize isolation criteria with the business (who can isolate, what severity justifies it) — during an incident is the wrong time to negotiate.

✅ Best Practice: pair manual isolation with Automatic Threat Analysis / Machine Quarantine for high-confidence detections — machines get contained even at 3 AM.

Common Mistakes

Mistake	Impact	Solution
Isolating a client without the Firewall component	Isolation cannot be performed	Include Firewall in the standard deployment
Trying to isolate a Linux endpoint	Unsupported (also: Analyze by Indicator, Deploy New Endpoints)	Use network-level containment for Linux
Assuming the operation waits forever	It ends when the Expire on window passes	Monitor the Push Operations table; Run Again
Forgetting the device is isolated after remediation	User can't work; tickets pile up	Make Release Computer an explicit closing step in the runbook
Fearing loss of management during isolation	—	Management traffic stays allowed by design; you can keep operating the device

Troubleshooting

Symptom: Isolate Computer push operation never completes for a device Environment: Windows/macOS client Root Causes & checks:

Firewall component not installed on that client — verify the deployed blades
Client offline — the operation waits until the Expire on window, then ends Partially completed and must be run again
Check the operation status in the Push Operations table (Scheduled / In progress / Partially completed / Completed / Failed)
Confirm client ↔ server connectivity (see Article 3) — ironically, isolation needs the management channel
Confirm the state in Computers > View: Host Isolation > Isolation Status

FAQ

Q: Can I still manage an isolated computer? A: Yes — management traffic remains allowed, so policies, push operations (including Release), and log collection keep working.

Q: Can the user browse or reach file shares while isolated? A: No. Only DHCP, DNS and management traffic are allowed.

Q: Does isolation require installing a policy? A: No — push operations act without policy installation.

Q: Can isolation happen automatically? A: Yes — Machine Quarantine in Automatic Threat Analysis restricts network access via the Firewall when triggers fire with sufficient confidence.

Q: How do I un-isolate several machines at once? A: Release Computer accepts one or more devices, like Isolate — and it is also available from the Computers view.

References

Check Point Harmony Endpoint Administration Guide (cloud / Infinity Portal) — Push Operations (Isolate/Release Computer, scheduling and expiration, supported operations)
Check Point Harmony Endpoint Administration Guide (cloud / Infinity Portal) — Viewing Computer Information (Host Isolation view) and Automated Attack Analysis (Forensics) (Machine Quarantine)

Revision History

Date	Version	Author	Changes
2026-07-16	1.0	Jorge Luiz	Initial version
2026-07-30	2.0	Jorge Luiz	Cloud-first revalidation: Push Operations run from Asset Management > Push Operations (Create operation flow), configurable Expire on (7/30/Custom) replaces the on-prem 24-hour timeout, cloud statuses and actions, Host Isolation view; removed SmartEndpoint/Reporting-tab and the R81.20 PDF reference

Supported Versions: Harmony Endpoint cloud management (Infinity Portal / Web Management); isolation on Windows and macOS clients Last Updated: 2026-07-30

WiliRGasparetto

well done Bro!