# 🛑 Isolating Infected Hosts

Time is money. The faster you act, the less damage occurs.

## 📝 The Response Log (Audit Trail)

```json
{
  "action": "ResponseAction",
  "type": "NetworkContainment",
  "status": "Success",
  "target_host": "FINANCE-PC-01",
  "initiator": "Analyst_Baris",
  "timestamp": "2024-03-15T10:55:00Z",
  "policy": {
    "allow_dns": false,
    "allow_edr_cloud": true,
    "allow_all_else": false
  }
}
```

## 🕵️‍♂️ Investigation Steps

### Step 1: Verification
* **Action**: `NetworkContainment`.
* **Policy**: The log confirms that the host can ONLY talk to the EDR cloud (`allow_edr_cloud: true`). This is vital. You don't want to lose your own access!

### Step 2: What happens next?
* The attacker loses their C2 connection.
* **Active shells die**.
* **Data exfiltration stops**.
* The user sees "No Internet".

### Step 3: Remediation
1. **Live Response**: Connect via EDR shell.
2. **Collect Artifacts**: Get the `Invoice_UPDATED.docx` file.
3. **Re-image**: Wipe the machine. Better safe than sorry.
