EDR containment actions
6 actions in the scorecard's EDR domain: which of eighteen platforms document each against a named target, and the vendor page that shows it. Read 2026-11-03 and 2026-11-04.
6actions
The grid for this domain
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | |||||
|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | |
| D3 Security6 of 6 documented | ||||||
| Google Security Operations6 of 6 documented | ||||||
| Palo Alto Cortex XSOAR6 of 6 documented | ||||||
| Splunk SOAR (Cisco)6 of 6 documented | ||||||
| Tines6 of 6 documented | ||||||
| BlinkOps5 of 6 documented, not ranked | BlinkOps: Kill process, not documented | |||||
| Cyware5 of 6 documented | Cyware: Kill process, not documented | |||||
| Swimlane5 of 6 documented | Swimlane: Kill process, not documented | |||||
| Torq4 of 6 documented | Torq: Kill process, not documented | Torq: Quarantine file, not documented | ||||
| Exabeam3 of 6 documented, not ranked | Exabeam: Kill process, not documented | Exabeam: Quarantine file, not documented | Exabeam: Run script or live response, not documented | |||
| Microsoft Sentinel3 of 6 documented | Microsoft Sentinel: Kill process, not documented | Microsoft Sentinel: Quarantine file, not documented | Microsoft Sentinel: Block hash, not documented | |||
| ThreatConnect3 of 6 documented, not ranked | ThreatConnect: Kill process, not documented | ThreatConnect: Quarantine file, not documented | ThreatConnect: Run script or live response, not documented | |||
| CrowdStrike Falcon Fusion SOAR0 of 6 documented, docs behind login | CrowdStrike Falcon Fusion SOAR: Isolate host, not documented | CrowdStrike Falcon Fusion SOAR: Release isolation, not documented | CrowdStrike Falcon Fusion SOAR: Kill process, not documented | CrowdStrike Falcon Fusion SOAR: Quarantine file, not documented | CrowdStrike Falcon Fusion SOAR: Run script or live response, not documented | CrowdStrike Falcon Fusion SOAR: Block hash, not documented |
| Dropzone AI0 of 6 documented | Dropzone AI: Isolate host, not documented | Dropzone AI: Release isolation, not documented | Dropzone AI: Kill process, not documented | Dropzone AI: Quarantine file, not documented | Dropzone AI: Run script or live response, not documented | Dropzone AI: Block hash, not documented |
| Mate Security0 of 6 documented | Mate Security: Isolate host, not documented | Mate Security: Release isolation, not documented | Mate Security: Kill process, not documented | Mate Security: Quarantine file, not documented | Mate Security: Run script or live response, not documented | Mate Security: Block hash, not documented |
| Prophet Security0 of 6 documented | Prophet Security: Isolate host, not documented | Prophet Security: Release isolation, not documented | Prophet Security: Kill process, not documented | Prophet Security: Quarantine file, not documented | Prophet Security: Run script or live response, not documented | Prophet Security: Block hash, not documented |
| Revelstoke (Arctic Wolf)0 of 6 documented, not ranked | Revelstoke (Arctic Wolf): Isolate host, not documented | Revelstoke (Arctic Wolf): Release isolation, not documented | Revelstoke (Arctic Wolf): Kill process, not documented | Revelstoke (Arctic Wolf): Quarantine file, not documented | Revelstoke (Arctic Wolf): Run script or live response, not documented | Revelstoke (Arctic Wolf): Block hash, not documented |
| ServiceNow Security Operations0 of 6 documented | ServiceNow Security Operations: Isolate host, not documented | ServiceNow Security Operations: Release isolation, not documented | ServiceNow Security Operations: Kill process, not documented | ServiceNow Security Operations: Quarantine file, not documented | ServiceNow Security Operations: Run script or live response, not documented | ServiceNow Security Operations: Block hash, not documented |
12of 18 document it
Isolate host
Cut a managed endpoint off from the network while keeping the sensor channel to the EDR console open, so analysts can still investigate.
Typical targets: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Cortex XDR, Carbon Black.
- D3 Security, native: CrowdStrike: Quarantine Host (Isolate Host); Microsoft Defender for Endpoint: Quarantine Hosts; Cortex XDR: Isolate Hosts; SentinelOne: Disconnect From Network; Carbon Black Cloud V2: Quarantine Devices. docs.d3security.com, read
- Google Security Operations, native: CrowdStrike Falcon: Contain Endpoint; Microsoft Defender ATP: Isolate Machine; Palo Alto Cortex XDR: Isolate Endpoint; Carbon Black Response: Isolate Host; Cisco AMP: Isolate Machine. cloud.google.com, read
- Palo Alto Cortex XSOAR, native: CrowdStrike Falcon: cs-falcon-contain-host; Microsoft Defender for Endpoint: microsoft-atp-isolate-machine; Cortex XDR: xdr-endpoint-isolate. github.com, read
- Splunk SOAR (Cisco), native: CrowdStrike: quarantine device; Microsoft Defender for Endpoint: quarantine device; Carbon Black Cloud (VMware-published): quarantine device; SentinelOne (SentinelOne-published): quarantine device. github.com, read
- Tines, native: CrowdStrike: Take action on hosts template (contain); Microsoft Defender for Endpoint: Isolate machine template; Cortex XDR: Create isolation for single endpoint template; Cisco Secure Endpoint: Append Isolation on Computer template. tines.com, read
- BlinkOps, native: CrowdStrike: Isolate Endpoint; Microsoft Defender for Endpoint: Isolate Machine; SentinelOne: Isolate Endpoint; Cortex XDR: Isolate Endpoint. docs.blinkops.com, read
- Cyware, native: CrowdStrike Falcon: Contain a Host; Microsoft Defender for Endpoint: Isolate a Machine; Cortex XDR: Isolate Endpoints. techdocs.cyware.com, read
- Swimlane, native: CrowdStrike Falcon V2: take action on host (containment); Microsoft Defender: Isolate; Palo Alto Cortex XDR: Isolate Endpoints. docs.swimlane.com, read
- Torq, native: CrowdStrike: Contain Host step; Microsoft Defender for Endpoint: Isolate or Unisolate device workflow template. kb.torq.io, read
- Exabeam, native: Microsoft Defender ATP service: Quarantine Host. docs.exabeam.com, read
- Microsoft Sentinel, native: Microsoft Defender for Endpoint (Logic Apps connector): Actions - Isolate machine. learn.microsoft.com, read
- ThreatConnect, partner: CrowdStrike Falcon Insight via the NetWitness Response Action Proxy integration: isolate_device. knowledge.threatconnect.com, read
Not documented on the pages read (6): CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations.
12of 18 document it
Release isolation
Lift a network isolation placed earlier, returning the endpoint to normal connectivity.
Typical targets: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Cortex XDR, Carbon Black.
- D3 Security, native: CrowdStrike: Unquarantine Endpoint; Microsoft Defender for Endpoint: Unquarantine Hosts; Cortex XDR: Unisolate Hosts; Carbon Black Cloud V2: Unquarantine Devices. docs.d3security.com, read
- Google Security Operations, native: CrowdStrike Falcon: Lift Contained Endpoint; Microsoft Defender ATP: Unisolate Machine; Palo Alto Cortex XDR: Unisolate Endpoint; Carbon Black Response: Unisolate Host. cloud.google.com, read
- Palo Alto Cortex XSOAR, native: CrowdStrike Falcon: cs-falcon-lift-host-containment; Microsoft Defender for Endpoint: microsoft-atp-unisolate-machine; Cortex XDR: xdr-endpoint-unisolate. github.com, read
- Splunk SOAR (Cisco), native: CrowdStrike: unquarantine device; Microsoft Defender for Endpoint: unquarantine device. github.com, read
- Tines, native: Microsoft Defender for Endpoint: Release machine from isolation template; CrowdStrike: Take action on hosts template (lift containment); Contain or release hosts in CrowdStrike from Jira story. tines.com, read
- BlinkOps, native: CrowdStrike: Lift Endpoint Isolation; Microsoft Defender for Endpoint: Release Machine Isolation; SentinelOne: Lift Endpoint Isolation; Cortex XDR: Lift Endpoint Isolation. docs.blinkops.com, read
- Cyware, native: CrowdStrike Falcon: Lift Host Containment; Microsoft Defender for Endpoint: Remove Machine from Isolation; Cortex XDR: Unisolate Endpoint. techdocs.cyware.com, read
- Swimlane, native: CrowdStrike Falcon V2: Lift Contained Endpoint; Microsoft Defender: Unisolate. docs.swimlane.com, read
- Torq, native: CrowdStrike: manage containment on a device workflow template; Microsoft Defender for Endpoint: Isolate or Unisolate device workflow template. kb.torq.io, read
- Exabeam, native: Microsoft Defender ATP service: Un quarantine Host. docs.exabeam.com, read
- Microsoft Sentinel, native: Microsoft Defender for Endpoint (Logic Apps connector): Actions - Unisolate machine. learn.microsoft.com, read
- ThreatConnect, partner: CrowdStrike Falcon Insight via the NetWitness Response Action Proxy integration: unisolate_device. knowledge.threatconnect.com, read
Not documented on the pages read (6): CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations.
5of 18 document it
Kill process
Terminate a named running process on an endpoint, by PID or name, from the response console or API.
Typical targets: CrowdStrike Falcon (Real Time Response), SentinelOne, Cortex XDR, Carbon Black.
- D3 Security, native: SentinelOne: Kill Processes. docs.d3security.com, read
- Google Security Operations, native: Carbon Black Response: Kill Process. cloud.google.com, read
- Palo Alto Cortex XSOAR, native: CrowdStrike Falcon: cs-falcon-rtr-kill-process; Cortex XDR: xdr-kill-process-script-execute. github.com, read
- Splunk SOAR (Cisco), partner: Carbon Black Cloud (VMware-published): kill process. github.com, read
- Tines, native: CrowdStrike: Kill an active process in CrowdStrike story. tines.com, read
Not documented on the pages read (13): BlinkOps, Cyware, Swimlane, Torq, Exabeam, Microsoft Sentinel, ThreatConnect, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations.
8of 18 document it
Quarantine file
Move a file on disk to the EDR quarantine store so it cannot execute, without deleting the evidence.
Typical targets: Microsoft Defender for Endpoint, Cortex XDR, CrowdStrike Falcon, SentinelOne.
- D3 Security, native: CrowdStrike: Quarantine Files; Microsoft Defender for Endpoint: Quarantine Files; SentinelOne: Quarantine Files. docs.d3security.com, read
- Google Security Operations, native: Microsoft Defender ATP: Stop and Quarantine a File on Specific Machine. cloud.google.com, read
- Palo Alto Cortex XSOAR, native: Cortex XDR: xdr-file-quarantine; Microsoft Defender for Endpoint: microsoft-atp-stop-and-quarantine-file; CrowdStrike Falcon: cs-falcon-apply-quarantine-file-action. github.com, read
- Splunk SOAR (Cisco), native: Microsoft Defender for Endpoint: quarantine file. github.com, read
- Tines, native: Microsoft Defender for Endpoint: Stop and quarantine file template. tines.com, read
- BlinkOps, native: Microsoft Defender for Endpoint: Stop and Quarantine File. docs.blinkops.com, read
- Cyware, native: Microsoft Defender for Endpoint: Stop Execution and Quarantine a File; Cortex XDR: Quarantine Files. techdocs.cyware.com, read
- Swimlane, native: Microsoft Defender: Stop and Quarantine. docs.swimlane.com, read
Not documented on the pages read (10): Torq, Exabeam, Microsoft Sentinel, ThreatConnect, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations.
10of 18 document it
Run script or live response
Execute a script or live response command on an endpoint to collect evidence or remediate.
Typical targets: CrowdStrike Falcon (RTR), Microsoft Defender for Endpoint (live response), SentinelOne (remote script), Cortex XDR.
- D3 Security, native: Cortex XDR: Run Script; Microsoft Defender for Endpoint: Run Live Response Commands; CrowdStrike: Execute Command On Single Endpoint. docs.d3security.com, read
- Google Security Operations, native: CrowdStrike Falcon: Run Script, Execute Command; Microsoft Defender ATP: Execute Live Response Command. cloud.google.com, read
- Palo Alto Cortex XSOAR, native: CrowdStrike Falcon: cs-falcon-run-script; Cortex XDR: xdr-run-script; Microsoft Defender for Endpoint: microsoft-atp-live-response-run-script; SentinelOne: sentinelone-run-remote-script (partner-supported pack). github.com, read
- Splunk SOAR (Cisco), native: Microsoft Defender for Endpoint: run script; CrowdStrike: run command, run admin command. github.com, read
- Tines, native: CrowdStrike: Execute RTR administrator command, active responder command, read only command templates; SentinelOne: Trigger Remote Script templates (Linux). tines.com, read
- BlinkOps, native: CrowdStrike: Run Command on a Single Host; Microsoft Defender for Endpoint: Run Script on Machine; Cortex XDR: Execute Python Script. docs.blinkops.com, read
- Cyware, native: SentinelOne: Run Remote Script; CrowdStrike Falcon: Execute Command Single Host (Real Time Response). techdocs.cyware.com, read
- Swimlane, native: CrowdStrike Falcon V2: Execute RTR Command, Execute Admin RTR Command. docs.swimlane.com, read
- Torq, native: Microsoft Defender for Endpoint: Execute Live Response step; SentinelOne: run remote script workflow templates. kb.torq.io, read
- Microsoft Sentinel, native: Microsoft Defender for Endpoint (Logic Apps connector): Actions - Run live response. learn.microsoft.com, read
Not documented on the pages read (8): Exabeam, ThreatConnect, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations.
11of 18 document it
Block hash
Add a file hash to the EDR blocklist or custom indicator list so it is prevented from running across the estate.
Typical targets: CrowdStrike Falcon (custom IOC), Microsoft Defender for Endpoint (indicators), SentinelOne (blocklist), Cortex XDR (block list).
- D3 Security, native: Carbon Black Cloud V2: Block Hashes; SentinelOne: Block Hash; Proofpoint Threat Response: Block Hashes. docs.d3security.com, read
- Google Security Operations, native: Palo Alto Cortex XDR: Add Hashes to Block List; Carbon Black Response: Block Hash; VMware Carbon Black Cloud: Create a Reputation Override for SHA-256 Hash. cloud.google.com, read
- Palo Alto Cortex XSOAR, native: Cortex XDR: xdr-blocklist-files; CrowdStrike Falcon: cs-falcon-upload-custom-ioc; Microsoft Defender for Endpoint: microsoft-atp-indicator-create-file; SentinelOne: sentinelone-add-hash-to-blocklist (partner-supported pack). github.com, read
- Splunk SOAR (Cisco), native: CrowdStrike: upload indicator; Microsoft Defender for Endpoint: submit indicator; SentinelOne (SentinelOne-published): block hash. github.com, read
- Tines, native: SentinelOne: Ban a Hash, Block a hash templates; Microsoft Defender for Endpoint: indicator templates; CrowdStrike: Upload a single IOC template. tines.com, read
- BlinkOps, native: SentinelOne: Ban Hash, Add to Block List; Cortex XDR: Add Files to Block List; CrowdStrike: Create Indicator; Microsoft Defender for Endpoint: Create or Update Indicator. docs.blinkops.com, read
- Cyware, native: SentinelOne: Add Hash to Blacklist; CrowdStrike Falcon: Update Indicators. techdocs.cyware.com, read
- Swimlane, native: Palo Alto Cortex XDR: Blacklist Files; CrowdStrike Falcon V2: Create Indicator; SentinelOne: blocklist items. docs.swimlane.com, read
- Torq, native: SentinelOne: Blacklist SHA1 Hashes workflow template; Microsoft Defender for Endpoint: Add or Update Indicator step; CrowdStrike: Create Indicator step. kb.torq.io, read
- Exabeam, native: Netskope service: update file hash lists. docs.exabeam.com, read
- ThreatConnect, native: CrowdStrike Falcon Insight: deploy File Indicators to Falcon (Extract app). knowledge.threatconnect.com, read
Not documented on the pages read (7): Microsoft Sentinel, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations.