Network Isolation Decision Aid
Mid-incident, someone has to decide for each segment: isolate now, contain and monitor, or pull it off the network. Describe each affected segment and get a recommendation with the reasons, the cost of every option, and the evidence to capture before you act. Starts with a sample VPN-to-domain intrusion; change it to match yours.
Cut this segment or host off from the rest of the network now, keeping your own management and EDR channel.
- An exploited edge appliance is an open door. Take the portal or management interface off the internet now.
- Restrict it first (disable the portal, block management access) rather than rebooting or patching, so the evidence on the device survives.
- Lateral movement is confirmed: the appliance is no longer the whole story. Scope the internal network and identity too.
Capture first
Logs are in hand; capture memory and running state before you change anything — memory is the most volatile and the first lost.
- Vendor forensic snapshot or support bundle, plus memory if the vendor supports it — before patch or reboot
- Running configuration export and the vendor integrity-check output
- VPN session, admin login and system logs from the device and from your SIEM or syslog copy
- Firewall and NetFlow logs for traffic from the appliance into the internal network
Cost of each option
- Isolate now (recommended): This stops a high-criticality service; there is no failover, so the service stays down until the system is rebuilt. The attacker learns they were seen on this host. Evidence is kept if you captured it first.
- Contain and monitor: The attacker keeps access for hours to days while you scope. It needs round-the-clock watching and a pre-agreed trigger to cut. It gives you the best chance to find every foothold and evict once.
- Full disconnect: Everything on the segment loses connectivity, including legitimate users and possibly your own remote management. This stops a high-criticality service; there is no failover, so the service stays down until the system is rebuilt. It stops spread and data theft immediately.
Leave it connected for now under tight restrictions and close watching, and cut it in a coordinated eviction.
- Lateral movement is confirmed and the attacker is active. Isolating this server alone warns them while they keep their other footholds.
- Restrict its egress and admin access now, find every foothold, then cut them all in one move.
Capture first
Capture the items below before you act. On most systems this takes minutes to a few hours, and a reboot or rebuild destroys it.
- Memory image, or a VM snapshot that includes memory
- Running processes, open network connections, services and scheduled tasks
- Operating system, web and application logs for the suspected window
- Firewall and flow logs for traffic to and from the server
Cost of each option
- Isolate now: This stops a medium-criticality service; only backups exist, so expect hours to days to restore elsewhere. The attacker learns they were seen on this host. Evidence is kept if you captured it first.
- Contain and monitor (recommended): The attacker keeps access for hours to days while you scope. It needs round-the-clock watching and a pre-agreed trigger to cut. It gives you the best chance to find every foothold and evict once.
- Full disconnect: Everything on the segment loses connectivity, including legitimate users and possibly your own remote management. This stops a medium-criticality service; only backups exist, so expect hours to days to restore elsewhere. It stops spread and data theft immediately.
Leave it connected for now under tight restrictions and close watching, and cut it in a coordinated eviction.
- You cannot isolate domain controllers without stopping sign-ins for the whole business, and an attacker with domain access can rebuild their access faster than you can remove it piece by piece.
- Contain now (restrict admin protocols to DCs, watch replication and privileged-group changes, move the team to out-of-band chat) and plan one coordinated eviction: tier-0 resets, krbtgt reset twice, C2 blocks.
- The attacker is likely to react, so keep the eviction window short (days, not weeks) and agree in advance what triggers an immediate disconnect.
Capture first
Capture the items below before you act. On most systems this takes minutes to a few hours, and a reboot or rebuild destroys it.
- VM snapshot with memory, or a memory image — do not power off a DC to capture it
- Security log (privileged group changes, Kerberos ticket requests, directory access) and Directory Service log
- Replication metadata and a list of recent changes to privileged groups, GPOs and AdminSDHolder
- Authentication logs from the identity provider and any sync or federation server
Cost of each option
- Isolate now: This stops a high-criticality service; failover or an alternative path is available, so the outage should be short. The attacker learns they were seen on this host. Evidence is kept if you captured it first. For domain controllers this means a domain-wide sign-in outage.
- Contain and monitor (recommended): The attacker keeps access for hours to days while you scope. It needs round-the-clock watching and a pre-agreed trigger to cut. It gives you the best chance to find every foothold and evict once.
- Full disconnect: Everything on the segment loses connectivity, including legitimate users and possibly your own remote management. This stops a high-criticality service; failover or an alternative path is available, so the outage should be short. It stops spread and data theft immediately.
Guidance only. The incident commander makes the call, with operations for anything safety-related. Record each decision, the reason and who approved it.
What this tool does
- Add each affected segment or system and describe it in seven answers: what is compromised, lateral movement, criticality, failover, how likely the attacker is to react, whether damage is happening now, and whether evidence is captured.
- Each segment gets one of three calls — isolate now, contain and monitor, or full disconnect — with the reasons in plain words.
- You also see the cost of all three options for that segment, so the trade-off is visible to whoever approves it.
- A capture-first list tells you which evidence to take before you act (memory, device and firewall/VPN logs), and when not to wait.
- Copy every decision as plain text for the incident log. Nothing leaves your browser.
How the recommendation is made
- Damage now beats everything. Encryption, wiping or data leaving the network means act first and capture afterwards.
- Edge appliances are isolated. An exploited VPN or firewall is an open door; restrict it rather than rebooting so the evidence survives.
- Domain controllers are contained and evicted in one move. Piecemeal fixes against an attacker with domain access get undone.
- Active operators with several footholds get a coordinated eviction. Cutting one host warns them while they keep the rest.
- Critical services without failover are contained, not cut, unless spread is confirmed or damage starts.
- OT boundaries follow safety first. Operations decides whether the plant can run without IT links.
Frequently asked questions
Why not isolate everything immediately?
Because isolation has costs. It stops services, it can destroy volatile evidence if machines are rebooted, and against an active operator it can tip them off while they still hold other footholds. When damage is happening now, act immediately. When it is not, a short period of tight containment and close watching often lets you find every foothold and remove them all at once.
Why does it never recommend isolating a domain controller straight away?
Isolating domain controllers stops sign-ins across the business, and an attacker who already has domain-level access can usually rebuild access faster than you can remove it piece by piece. The usual answer is to contain (restrict admin access to DCs, watch replication and privileged changes), plan a coordinated eviction within days, and agree a trigger that justifies an immediate disconnect. If encryption or wiping starts, the aid switches to full disconnect.
What should we capture before isolating?
The most volatile evidence first: memory and running state, then logs that roll over quickly (appliance, VPN and firewall logs), then disk. For an edge appliance, use the vendor's supported forensic or support-bundle process before you patch or reboot. If damage is happening now, isolate first and capture afterwards from the isolated systems, without powering them off.
Does this replace the incident commander's judgement?
No. It makes the usual trade-offs explicit and gives you a defensible starting point. The incident commander decides, with operations for anything that touches safety, and the reason for each decision should be recorded.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.