Containment

Definition

Containment is reversible by design in most cases. A host can be released from isolation and an account re-enabled, which is why approval and rollback matter. A containment that cannot be undone needs a higher bar.

Across five domains, the scorecard on this site counts 25 containment actions that vendors may document: EDR, identity, email, cloud and network.

Containment in Swimlane (Turbine)'s documentation

Swimlane's connector documentation for CrowdStrike Falcon lists a take action on host action described as containment, which is a documented host containment step for that platform. vendor claim docs.swimlane.com, read 2026-11-03

The example names a vendor and its own page. A vendor's use of Containment may differ from the definition above; the rubric uses the definition on this page.

Terms related to Containment

• Time to contain: Time to contain is the elapsed time from the first detection signal on an incident to the first action that stops the attacker spreading or acting.
• Eradication: Eradication removes the attacker's foothold from the estate: malware deleted, persistence removed, credentials rotated and vulnerable systems fixed.
• Host isolation: Host isolation cuts a managed endpoint off from the network while keeping the sensor channel to the EDR console open, so analysts can still investigate.
• Session revocation: Session revocation ends a user's active sessions and invalidates refresh or access tokens, so a stolen session stops working.
• Account disablement: Account disablement turns off a user or service account in the identity provider so no new sign-in succeeds.

All terms are in the glossary.