MDATP Python automation
Automate machine isolation with Python script
In this blog, we will use Python (!) to automate a response to a high severity alert, by isolating the machine involved....
Updated Jun 03, 2019
Version 2.0
Blog Post
Requirement: Auto isolation of machine due to a compromise, such as traffic to a suspected C2 server is found.
The SMB is actively looking for a threat protection solution and evaluating them.
Scenario: SMB, has between 10 and 100 computers, very small number of tech support staff, not using an MSP for daily monitoring or support. Has a small number of servers, including file servers on-prem that are accessed by VPN.
It's well after hours, the IT support tech is sleeping. Another employee is connected to the company network through the VPN.
Traffic to a suspected C2 server is then identified on the laptop.
The security application should automatically isolate the laptop, without human intervention, due to the possible malicious traffic.
In an enterprise you may or may not take advantage of that type of functionality, but with an SMB, it could be a life saver.