Task 03: Isolate a test device, run Live Response commands, collect artifacts, then de-isolate

---

Security Architecture Team

1. Establish when to use full isolation (for example, signs of lateral movement, credential theft, or ransomware spread) versus selective isolation (controlled drills or low-risk investigations).

2. Identify essential business apps (like Teams, Outlook, or service desk tools) that remain functional during selective isolation and add them to the allowed-services list for continuity.

3. Capture isolation criteria, exception rationale, and fallback plans in your security runbook or incident response policy to ensure repeatability and auditor-ready traceability.

---

Security Engineering and Administration

1. In the Defender XDR portal’s leftmost pane, select Assets > Devices.

2. Select winvm-mde.

3. In the upper-right corner of the page, select the ellipsis > Isolate Device.

   

4. In the dialog, select the checkbox for Allow Outlook, Teams and Skype….

5. Under Comment, enter Isolate Device, then select Confirm.

6. Close the flyout pane.

7. Refresh the page, and under the Last action details section you should see:

   Item	Value
   Type	Device isolation
   Status	Completed

   

   It may take a few minutes to complete.

   If you shut down winvm-mde, it will need to be started for this to complete.

8. In the upper-right corner of the page, select the ellipsis > Release from isolation.

   

9. In the dialog’s text box, enter Release from Isolation, then select Confirm.

   

10. Close the flyout pane.

---

SOC Analyst

1. In the leftmost pane, select Assets > Devices.

2. Select winvm-mde.

3. At the top of the page, select the Timeline tab.

   

4. In the search box above the table, enter isolate.

5. Confirm you see the [IsolateResponse] and [UnIsolateResponse] events.