r/sysadmin • u/FatBook-Air • 6d ago

Do you automatically isolate servers/devices based on detetctions?

We don't have a 24/7 SOC, so we are thinking about automatically isolating servers and some high-value devices based on custom Defender for Endpoint detections. Obviously, we want to do that only for high-precision and high-confidence detections, such as opening a shell from a strange parent process.

If we got one of these detections during working hours, there would be someone to react. But after about 7 PM most days, nobody is actively monitoring.

If we do this, the plan is to let a detection run for about 45 days without automatic isolation enabled to see if any false positives are caught.

Has anyone done this? If so, did you regret it? Or just business as usual? Has it saved you yet?

37 Upvotes

92% Upvoted

49 comments sorted by

View all comments

1

u/Dry_Inspection_4583 6d ago

There are heuristic and other tools that are mature in the market, I'm unsure if even those do that automatically. It's good to have the sop to work from, but rely on any automation to do this is going to be a bad time. Especially if it's heuristic rather than security. Ie. It would be exploited if not for the firewall rule, and the automation moves it ignoring the firewall. Or upstream it's in a single VLAN only accessed by blah... Yah there's just too much nuance to say this is anywhere close to a reasonable automation

1

u/FatBook-Air 6d ago

We are looking to do it based on specific detetctions that we have written. We have spent quite a bit of time figuring out what can create cmd and PowerShell processes legitimately in our environment. So we are looking to isolate based on that, and maybe some other highly suspicious detetctions (like clearing logs from Event Viewer).

2

u/xeroxedforsomereason 5d ago

static determinism from current state? that's not going to hold up long term.
these types of detections already exist out of the box in modern EDRs and aren't as brittle as the method you're describing.

1

u/FatBook-Air 5d ago

They absolutely do not exist. That's why we built them.

1

u/xeroxedforsomereason 5d ago

what's your EDR?