• Capture Client
• Overview
• Deep Visibility
  • Getting Started
  • Accessing SentinelOne Help
  • Finding Threat Hunt Queries in SentinelOne
• Hunter Chrome Extension
  • Installing SentinelOne Hunter Chrome Extension
  • SentinelOne Hunter Modes
  • Licensing SentinelOne Hunter Chrome Extension
• Network Control
  • Getting Started with Network Control
  • Configurable Network Quarantine
  • Network Status
  • Network Quarantine Operations
• Remote Shell
  • SentinelOne Remote Shell Use Case 1
  • SentinelOne Remote Shell Use Case 2
• Rogues Detection
• Useful References
• SonicWall Support
  • About This Document

Configurable Network Quarantine

One of the basic mitigation actions for an infected endpoint is to Disconnect it from the Network and put it in Network Quarantine. This ensures that a threat cannot attack other endpoints, or communicate with the external network from the infected endpoint.

You can set the automatic Disconnect from Network option in the Policy Settings. Endpoints are only disconnected if a threat is found, after the threat is executed. Endpoints are not disconnected if a threat is detected pre-execution (by the Reputation or Static AI engines) because the threat is not active.

With Network Quarantine, you can configure rules to allow specific network traffic to communicate with quarantined endpoints. By default, only the Agents can communicate with the Management Console if they are disconnected from the network.

For example, allow remote access from specific IP addresses to the infected endpoints to investigate or respond to incidents. Or allow the endpoints to send data to a specific server.