VMware Carbon Black Cloud EDR - Isolate/Unisolate Assets

VMware CB EDR - Isolate Assets quarantines each of the assets returned by the selected query or assets selected on the relevant asset page.

The VMware Carbon Black EDR (Carbon Black CB Response) network isolation functionality allows administrators to isolate endpoints that may be actively involved in an incident, while preserving access to perform Live Response on that endpoint and collect further endpoint telemetry.

VMware CB EDR - Unisolate Assets restores full network connectivity to each of the assets (endpoints) that are the result of the query.

📘

NOTE

To use the actions below, you must successfully configure a VMware Carbon Black EDR (Carbon Black CB Response) adapter connection.

Required Fields

These fields must be configured to run the Enforcement Set and apply to both Enforcement Actions described in this document.

• Use stored credentials from VMware Carbon Black EDR (Carbon Black CB Response) adapter - Select this option to use credentials from the adapter connection. By default, the first connection is selected.

  • When you select this option, the Select Adapter Connection drop-down becomes available. Select the adapter connection to use for this Enforcement Action.

  📘

  Note

  To use this option, you must successfully configure a VMware Carbon Black EDR (Carbon Black CB Response) adapter connection.

Isolate in VMware Carbon Black EDR

To configure the VMware CB EDR - Isolate Assets action, do as follows:

1. Define a unique action name.
2. If you are using multi-nodes, choose the Axonius node to use to interact with the adapter when executing the enforcement action.
3. Save the action.

Unisolate in VMware Carbon Black EDR

To configure the VMware CB EDR - Uninsolate Assets action, do as follows:

1. Define a unique action name.
2. If you are using multi-nodes, choose the Axonius node to use to interact with the adapter when executing the enforcement action.
3. Save the action.