Leveraging quarantine to isolate agents

In Chapter 1, Centralizing Logs, we learned about built-in actions in log forwarding profiles and we saw that there is a quarantine option. So, how can this option be leveraged to protect the core network?

If suspected devices are not allowed to connect under any circumstance, access can be declined by checking the Block login for quarantined devices checkbox as shown in the following screenshot, which will make it impossible for devices that were placed in quarantine to connect. This could make remediation more difficult as IT will not be able to simply connect to the device over a secured connection. This could cause some frustration with a quarantined user as they may be confused about why they are unable to connect, and they won't be able to do anything until staff have resolved the situation:

Figure 2.33 – Blocking access completely for quarantined devices

The quarantine message can be customized via...