> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/isolate-an-endpoint.md). # Isolate an endpoint When you isolate an endpoint, you halt all network access on the endpoint except for traffic to Cortex Cloud. This can prevent a compromised endpoint from communicating with other endpoints, thereby reducing an attacker’s mobility on your network. After the agent receives the instruction to isolate the endpoint and carries out the action, Cortex Cloud shows an **Isolated** status. To ensure an endpoint remains in isolation, agent upgrades are not available for isolated endpoints. When isolated, the endpoint will still allow: * DHCP and HTTPS outgoing traffic for root user * DNS traffic {% hint style="info" %} ### Note IP-based file storage protocol traffic will also be blocked. This might affect endpoint functionality if the endpoint uses such mounts. {% endhint %} Network isolation is supported for endpoints that meet the following requirements: | Operating System | Prerequisites | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Windows | | | Mac |

Network isolation on Mac endpoints does not terminate active connections that were initiated before the agent was installed on the endpoint.

| | Linux |

Network isolation on Linux endpoints is based on the defined IP addresses and ports.

| How to isolate an endpoint 1. Go to Investigation & Response → Response → Action Center → **New Action** and select **Isolate**. You can also initiate the action (for one or more endpoints) from the **Isolation** page of the **Action Center** or from Endpoints → Endpoint Management → **Endpoint Administration**. 2. Enter a **Comment** to provide additional background or other information that explains why you isolated the endpoint. After you isolate an endpoint, Cortex Cloud displays the **Isolation Comment** under Action Center → **Isolation**. If needed, you can edit the comment from the right-click pivot menu. 3. Click **Next**. 4. Select the target endpoint that you want to isolate from your network.

Tip

If needed, Filter the list of endpoints.

5. Click **Next**. 6. Review the action summary and click **Done** when finished. In the next heartbeat, the agent will receive the isolation request from Cortex Cloud. 7. To track the status of an isolation action, go to Action Center → Currently Applied Actions → **Endpoint Isolation**. If after initiating an isolation action, you can cancel the action by right-clicking the action and selecting **Cancel for pending endpoint**. You can cancel the isolation action only if the endpoint is still in `Pending` status and has not been isolated yet. 8. After you remediate the endpoint, cancel endpoint isolation to resume normal communication. You can cancel isolation from Actions Center → Isolation or from Endpoints → Endpoint Management → **Endpoint Administration**. From either place right-click the endpoint and select Endpoint Control → **Cancel Endpoint Isolation**. {% hint style="info" %} ### Note If file system operations become unresponsive during isolation, such as being unable to list folder content, unmount the mounted network shares. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/response-actions/isolate-an-endpoint.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.