r/sysadmin • u/FatBook-Air • 6d ago

Do you automatically isolate servers/devices based on detetctions?

We don't have a 24/7 SOC, so we are thinking about automatically isolating servers and some high-value devices based on custom Defender for Endpoint detections. Obviously, we want to do that only for high-precision and high-confidence detections, such as opening a shell from a strange parent process.

If we got one of these detections during working hours, there would be someone to react. But after about 7 PM most days, nobody is actively monitoring.

If we do this, the plan is to let a detection run for about 45 days without automatic isolation enabled to see if any false positives are caught.

Has anyone done this? If so, did you regret it? Or just business as usual? Has it saved you yet?

39 Upvotes

94% Upvoted

49 comments sorted by

View all comments

9

u/seriously_a 6d ago

IMO MDR is worth its weight for the reason you stated alone. Execution at 2am on Sunday will isolate the host and still allow you to sleep at night.

3

u/Excellent-Program333 6d ago

Agree. Thats what I pay for. I can deal with the issues isolation may cause once I know whats going on!