What is the meaning of "isolation" as it applies to the Carbon Black EDR sensor?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What is the meaning of "isolation" as it applies to the Carbon Black EDR sensor, and if it is kept in a state of "isolation", what will happen to the endpoint?

Environment

• Carbon Black EDR Server: All Supported Versions
• Carbon Black EDR Sensor: All Supported Versions

Resolution

When an endpoint is isolated, its connectivity is limited to the following (unless you have created network isolation exclusions):

• The Carbon Black EDR server can communicate with an isolated computer.
• To allow the sensor to communicate with the Carbon Black EDR server, ARP, DNS, and DHCP services remain operational on the sensor’s host. (For Windows operating systems prior to Vista, ICMP (for example, ping) will remain operational.)
• DNS and DHCP are allowed through on all platforms. This is required for proper communications to the Carbon Black EDR server. Protocols are allowed by UDP/53, UDP/67, and UDP/68.
• ICMP is allowed on the following operating systems:-Windows (operating systems prior to Vista)-OSX -Linux
• UDP is blocked on all platforms.

While in the isolated state, the endpoint will only be able to communicate to the items listed. Disabling isolation will be in the console or locally on the endpoint (7.4.1-win+) Restore Connectivity to an Isolated Endpoint locally using the CbEDRCLI

For sensors prior to 7.4.1-win, a reboot of the system will remove isolation until the sensor checks in with the server, this could take a few minutes depending on endpoint boot time. In 7.4.1+ the isolation feature is persistent throughout reboot if it was still enabled prior. 

Additional Information

  Restore Connectivity to an Isolated Endpoint locally using the CbEDRCLI