Isolating a device and reverting isolation

1. Click Alerts in the top navigation bar.
2. Click the alert name to open the Alert detail page.
3. Click Respond at the top of the page.
4. In the Responding to <alert name> dialog box, select Host Isolation [Win/Linux].
   
5. Click Confirm.

1. Click Alerts in the top navigation bar.
2. At the end of the row for the alert you want to act on, click the ellipses menu and select Respond.
3. Select Host Isolation [Win/Linux] and click Confirm.

NOTE  To act on multiple alerts at once, select the check box for each alert, then above the table, click Respond. The dialog confirms how many items you are responding to.

Result

A confirmation message appears showing that the response was submitted. On the alert detail page, the Response card marks Isolated with a green check once the action completes. In the alerts list, the response column displays a green I badge — hover over it to see the Isolate tooltip.

1. Navigate to Organizations > Devices.
2. Click the device name to open its Device details.
3. At the top of the page, click Isolate.
4. Click OK in the confirmation dialog box that reads "Are you sure you wish to isolate host?"

Result

The Isolate button label changes to Revert Isolation, confirming that the isolation request was accepted. The change is delivered to the agent on its next check-in.

1. Navigate to Organizations > Devices, or open a location and select its Devices tab.
2. Select the checkbox for each device you want to isolate.
3. Next to the Scan button, click the ellipses menu and select Isolate.
4. Confirm the prompt, which lists the names of the devices you selected.

NOTE  If any selected device is already isolated, the console prompts you to deselect it before continuing. Deselect the named devices and retry.

Result

The isolation request is queued for each selected device and is delivered on each device's next check-in. The Status column in the Devices list updates to Isolated once each device applies the change.

1. Navigate to the ransomware policy you want to edit.
2. Under Response Options, select the Isolate Host check box.
3. Save the policy.

NOTE  The Isolate Host check box is enabled by default on new ransomware policies.

1. Navigate to the automated response policy you want to edit.
2. In the Severity Response Actions table, select the desired template (Minimal, Moderate, Aggressive) and enable/disable the Isolate column for each severity level (Medium, High, Severe) that should trigger isolation.
   
3. Optionally, configure rule-specific overrides to turn isolation on or off for individual detection rules.
4. Save the policy.

NOTE  Isolation cannot be enabled for low-severity alerts in the Severity Response Actions table. That cell is locked to the rule default to prevent isolating devices over low-confidence detections.

Result

When a qualifying alert fires, Datto EDR isolates the affected device without analyst involvement. A system notification titled Device has been isolated appears in the notification bell menu, and the Respond > Responses list shows the name of the policy in the Initiated By column. Manual isolations show the user's email address in that column instead.

Automated response policies evaluate in priority order: a rule-specific override takes precedence, then the severity-level setting, then the rule's own recommended response as a fallback. To review the full evaluation logic, open an automated response policy and click View Workflow.

Work down this table. The first signal that matches tells you which console to use for the revert.

NOTE  Isolating a device through Datto RMM does not produce an Isolated status in Datto RMM. That status is reserved for isolation applied by Datto EDR. An RMM-isolated device shows Needs Attention instead. Misreading Needs Attention as "not isolated" is the most common misdiagnosis in multi-product environments.

If the consoles disagree, or a device is unreachable and you need certainty, a technician on the endpoint can confirm that Datto EDR is holding the isolation. All three of the following are true when Datto EDR has isolated the device:

• The Datto EDR Agent (HUNTAgent) service is running, as shown in Task Manager or Services.msc.
• The Datto EDR status JSON file has been updated within the last three minutes.
• The status file reports host isolation — the Isolated property is set to true.

NOTE  These checks confirm which product isolated the device. They do not release the isolation. Always revert isolation from the product's console using the steps in this guide.

1. Navigate to Organizations > Devices and click the isolated device.
2. At the top of the page, click Revert Isolation.
3. Click OK in the confirmation prompt that reads "Are you sure you wish to restore host?"

Result

The button label returns to Isolate and the device status returns to Online once the agent applies the change.

1. Navigate to Organizations > Devices, or open a location and select its Devices tab.
2. Select the checkbox for each isolated device you want to restore.
3. Click the ellipses menu in the list header and select Revert Isolation.
4. Confirm the prompt, which lists the names of the selected devices.

Result

The revert request is delivered to each selected device on its next check-in. The Status column in the Devices list returns to Online as each device applies the change.

1. Open the alert and at the top of the page, click Respond.
2. In the Responding to <alert name> dialog, select Host Isolation Restore.
3. Click Confirm.

Result

Datto EDR reverts isolation on the device and restores its ability to reach the internet and other devices on the network.

If the device was isolated by Datto RMM or RocketCyber, the Datto EDR steps above do not release it. Use the product that applied the isolation.

NOTE   Datto RMM's Isolate and Revert Isolation buttons appear only for Windows devices and only when standalone Ransomware Detection or Datto Endpoint Security is enabled on the account. Both actions run a job on the device, so the device must be online.