Put a Device in Quarantine Using ExtremeCloud IQ Site Engine

1. Select an alert on AlertsSecurity AlertsAll Alerts in the Device Security portal.

   You can only select one device at a time to quarantine.
2. Click MoreSend to…Quarantine via ExtremeCloud IQ.

3. Add a comment.

   After you enter a comment, the Send button changes from gray to blue, indicating that you can proceed.

4. Send the quarantine request.

   Device Security sends a command through Cortex XSOAR to all configured ExtremeCloud IQ Site Engine instances to add the device to the quarantine end-system group. The instance or instances that have an end-system with a matching MAC address apply the quarantine. The device remains in quarantine while you investigate the cause of the alert. Once it's resolved, you can then use the Release via ExtremeCloud IQ option.

   After you click Send, a link appears. When you click it, a new browser window opens to the Cortex XSOAR work plan for this action.

   To confirm that the quarantine command was sent, click the link to the Cortex XSOAR work plan for this action.

   For the link in Device Security to open the corresponding work plan in Cortex XSOAR, you must already be logged in to your cloud Cortex XSOAR instance before clicking on the link.

   If you have an on-premises Cortex XSOAR, you need to search the incidents on your Cortex XSOAR to find the work plan.

   Follow the path through the work plan to see if the action completed successfully, or to triage where the action may have failed.