Automating Client Isolation

The Client Isolation Script uses hosts added to a Threat Response list as a trigger moving a SEP Client to a Quarantine group. All methods and APIs used in the scripts are publicly available.  I will not cover the specifics of each API, only the required information from each application.

Threat Response

Hosts that require isolation can be automatically added to a Threat Response list using a match condition or as a manual response  by a Security Analyst.

Endpoint Protection

The Endpoint Protection API allows for retrieval of a system hardwareKey, which is required for the subsequent move computer API. 

Basic Requirements:

• Tested on Proofpoint Threat Response 4.x
• Tested on Symantec Endpoint Protection 14.x
• PowerShell script runs local on SEP Management server
• The provided PowerShell scripts

Link to the script

ptr-sep-isolate-host