Purpose


Use this procedure to quickly isolate a suspected compromised endpoint using CrowdStrike Falcon.

Isolation, called Network Contain in CrowdStrike, restricts the device's network communication while allowing CrowdStrike to continue communicating with the endpoint.

When to Use


Use Network Contain when:

  • Malware or suspicious activity is detected.
  • Unauthorized remote access is suspected.
  • A user may have allowed an attacker onto the computer.
  • Cybersecurity instructs IT Ops to isolate the device.
  • Immediate containment is required to prevent potential spread.

⚠️ Important


Before isolating the device:

  • Confirm the correct hostname/device.
  • Do not isolate a server, Domain Controller, POS server, or other critical infrastructure without Cybersecurity / IT leadership approval unless required under an active incident-response procedure.
  • Isolation will normally cause the user's network access to stop.


If you are unsure whether the device should be contained, escalate to Cybersecurity.

Procedure


1. Sign in to CrowdStrike Falcon


Open the CrowdStrike Falcon Console and sign in with your authorized account.


2. Find the Device


Navigate to:


Host Setup and Management → Host Management

Search for the device using the:

  • Hostname
  • Username
  • IP address, if required


3. Verify the Device


Before taking action, confirm:

  • Hostname
  • User
  • Operating System
  • Last Seen / Online status


Make sure you have selected the correct endpoint.


4. Isolate the Endpoint


Select the device.


From the device actions, select:

Network Contain

Confirm the action when prompted.


5. Confirm Isolation


Refresh the device information and verify the containment status shows:

Contained


If the status shows Containment Pending, allow CrowdStrike to complete the action and check again.

Validation


✅ Endpoint shows Contained in CrowdStrike.

✅ Correct hostname was isolated.

✅ Incident/FreshService ticket has been updated.

✅ Cybersecurity or the incident owner has been notified.

What to Record in the Ticket


Add the following:


Device:
User:
Time Contained:
Reason:
CrowdStrike Status: Contained
Performed By:
Related Alert/Incident:


Example:

Endpoint LAPTOP-123 network contained in CrowdStrike at 2:35 PM due to suspected unauthorized remote-access activity. Containment confirmed successfully. Cybersecurity notified for investigation.

Removing Isolation


Do not lift containment simply because the user says the computer is needed.


Containment should only be removed after:

  1. Cybersecurity / incident owner confirms the investigation or remediation is complete.
  2. Approval is given to reconnect the endpoint.


In CrowdStrike:


Host Management → Select Device → Lift Containment


Confirm the endpoint returns to:

Normal

Escalation


Escalate to Cybersecurity / IT Management if:

  • You are unsure whether containment is appropriate.
  • The affected system is a server or critical business system.
  • CrowdStrike cannot contain the endpoint.
  • The device remains Containment Pending.
  • Multiple endpoints appear affected.
  • There is evidence of credential theft, lateral movement, data access, or ransomware.

Evidence to Capture


Where applicable, attach or record:

  • CrowdStrike alert/detection
  • Hostname
  • Username
  • Time of containment
  • Screenshot of containment status
  • Related FreshService Incident number
  • Actions already completed

Completion Criteria


The procedure is complete when:


✅ Correct endpoint is contained
✅ Containment is verified in CrowdStrike
✅ FreshService ticket is updated
✅ Cybersecurity / incident owner is notified