SOP-006: Endpoint Isolation During a Suspected Compromise¶

Sep 29, 2026 · @Lloyd

1. Document Control¶

2. Purpose and Scope¶

This SOP contains a workstation or laptop suspected of compromise quickly and consistently. It stops spread and data exfiltration while preserving evidence for investigation.

In scope: organization-managed Windows, macOS, and Linux endpoints at a generic small office. Triggers include EDR or antivirus alerts, ransomware indicators, confirmed phishing payload execution, and unusual outbound traffic flagged by monitoring.

Out of scope: servers, cloud workloads, and mobile devices, which follow separate playbooks.

3. Isolation Methods¶

Use the first method available.

4. Procedure A: Contain¶

Run top to bottom. Do not power off or reboot the device at any point: shutdown destroys volatile evidence such as running processes, network connections, and memory-resident malware.

1. Open an incident ticket. Record the detection time, reporting source, hostname, IP and MAC address, logged-in user, and triggering alert.
2. Tell the user to stop using the device but leave it powered on.
3. Isolate the device using the highest-priority method available (Section 3).
4. Confirm the device no longer reaches internal or internet resources, other than the EDR console if used.
5. If credential theft is suspected, disable or reset the user's credentials and revoke active sessions and tokens.

5. Procedure B: Preserve, Scope, and Escalate¶

1. Following the forensic procedure, capture memory and collect relevant logs: EDR telemetry, Windows Event Logs, and proxy, DNS, and firewall logs. Keep a chain-of-custody record for everything collected.
2. Search EDR and SIEM for the same indicators of compromise (file hashes, domains, IPs) on other endpoints. Isolate any other affected host with Procedure A.
3. Notify the Incident Response Lead within the time set in the IR plan. The IR Lead decides whether legal, management, customers, or regulators must be told.
4. Do not reconnect the device until the IR Lead approves. The normal path is reimage from a known-good baseline, verify, then return to service.
5. After closure, record the timeline, actions, and lessons learned. Update detection rules and this SOP as needed.

6. Verification¶

• The device cannot reach internal or internet resources (other than the EDR console)
• The device was not powered off before evidence was collected
• The incident ticket holds the timeline, evidence list, and chain-of-custody record
• An IOC search across other endpoints was run and its result recorded
• Reconnection happened only after IR Lead approval

7. Responsible Parties¶

8. Control Mapping¶

Verify each reference against the published text before changing status to Reviewed. Incident handling in this SOP follows NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management (April 2025), which organizes incident response around the NIST CSF 2.0 functions. Containment and evidence preservation fall under CSF Respond; reimaging and return to service fall under Recover.

9. Revision History¶