Identification and Quarantine of Compromised Devices | GlobalProtect now makes it easier for you
to block compromised devices from
your network by allowing you to track compromised devices using
unique attributes, such as the hardware serial number of the device
and unique host information. This ability can be preferable to blocking
a compromised endpoint from a network based on its IP address, because
if a device’s IP address changed (for example, if a user moved their
endpoint from a work location to their home), security policies
based on IP addresses could allow the endpoint back on the network. After
GlobalProtect identifies a device as compromised (for example, if
GlobalProtect detects that a device has been infected with malware
and is performing command and control actions), it can add the device
to a quarantine list and permanently block it from accessing the network.
You can set security policies to quarantine the device or manually
add it to a quarantine list. | 
