Host isolation
Host isolation cuts a managed endpoint off from the network while keeping the sensor channel to the EDR console open, so analysts can still investigate. It is the most common first containment action on an endpoint, and release of the isolation is its reverse.
Definition
Isolation stops lateral movement and data exfiltration from that machine. It also stops the user working, so scope and approval matter on shared and critical servers.
Ask whether the platform can release isolation and whether it records who did either. Both are actions the scorecard counts.
Host isolation in Google Security Operations's documentation
Google's SOAR documentation describes a playbook as a trigger, actions such as enrichment, notification and host isolation, and flows that branch with if-then-else logic, in a page updated 2026-10-28. vendor claim docs.cloud.google.com, read
The example names a vendor and its own page. A vendor's use of Host isolation may differ from the definition above; the rubric uses the definition on this page.