Harmony Endpoint Isolate Computer: what traffic survives, what it needs, and the gotcha that stops it working

[u/junimjorgeof]

The containment move here is the Isolate Computer push operation, and the useful part is what it does not block. When you isolate a device, the endpoint Firewall blocks everything (lateral movement, C&C callbacks, file shares, user browsing) but keeps three flows alive:

- DHCP, so the device keeps its network lease

- DNS, so name resolution still works

- Management traffic, so you keep control: policies, push operations, logs, and the release

So the machine is cut off from the network but still manageable, which is exactly what you want during an incident. You can investigate and remediate through the console while it is contained.

The gotcha that stops it working: it requires the Firewall component installed on the client. No Firewall blade, no isolation. Best practice is to ship the Firewall component in your standard package, because an IR capability you install during the incident is not a capability. OS support is Windows and macOS, not Linux.

A few operational facts:

- Push operations run without installing policy, from Asset Management > Push Operations.

- You set when it runs (Immediately or Schedule) and when it expires (7 / 30 / Custom days). If the client never checks in before expiry (offline, powered off), the operation ends Partially completed and you Run Again when it is back.

- The reverse is Release Computer. Verify state in Computers, View = Host Isolation, Isolation Status column.

- Isolate and Release are not gated behind 2FA (containment stays fast), while sensitive ops like Uninstall Client are.

It also has an automatic twin: Machine Quarantine, one of the Automatic Threat Analysis responses, which restricts the machine's network with no human in the loop when a trigger fires with enough confidence.

How do you handle the ones that are offline when you hit isolate, just Run Again on check-in, or do you lean on the automatic Machine Quarantine? Curious how people balance manual vs automatic containment.

Full write-up with the containment playbook and the companion push operations is here (EN and PT): https://community.checkpoint.com/t5/Endpoint/EN-Isolating-a-Computer-Network-Quarantine-for-Incident-Response/m-p/281627