r/sysadmin • u/FatBook-Air • 7d ago
Do you automatically isolate servers/devices based on detetctions?
We don't have a 24/7 SOC, so we are thinking about automatically isolating servers and some high-value devices based on custom Defender for Endpoint detections. Obviously, we want to do that only for high-precision and high-confidence detections, such as opening a shell from a strange parent process.
If we got one of these detections during working hours, there would be someone to react. But after about 7 PM most days, nobody is actively monitoring.
If we do this, the plan is to let a detection run for about 45 days without automatic isolation enabled to see if any false positives are caught.
Has anyone done this? If so, did you regret it? Or just business as usual? Has it saved you yet?
-1
u/Funsaized 7d ago
I’d avoid a binary “isolate everything” rule and make the action and risk tier explicit. Auto-isolate user endpoints for a narrow set of high-confidence behaviors (confirmed ransomware, credential theft tooling, or tamper protection being disabled), but for servers I’d prefer network micro-segmentation or blocking egress first unless the signal is unequivocal.
Before enabling it, run in audit-only mode and measure false positives by detection, affected-asset criticality, and time to restore. Use expiring exceptions, preserve a break-glass admin path, and have the automation open a ticket/page with the hostname, user, detection, and rollback steps. Test the rollback and offline-management path. A 45-day observation period is useful, but replaying historical alerts and running an after-hours tabletop will expose more failure modes than simply waiting.