isolate_host
Quarantine a compromised host by restricting network access. Choose full, partial, or monitoring isolation to contain threats and limit damage.
Instructions
Isolate a compromised host from the network.
Quarantines a host by restricting its network access. This is typically implemented through network access control (NAC), endpoint security tools, or SDN/firewall rules.
Args: hostname: Hostname or IP to isolate isolation_level: "full" (complete isolation), "partial" (limited access), or "monitoring" (monitor only) reason: Reason for isolation duration_hours: Duration (0 = manual removal required)
Returns: Dictionary containing isolation status and details
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | ||
| hostname | Yes | ||
| duration_hours | No | ||
| isolation_level | No | full |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |