EDR

Sam approved L120

1. Retain facts. P120 records Excel starting PowerShell on L120. AL120 is already under review. No isolation has been requested. This exercise begins after Dana reviews AL120 from L120’s online Windows sensor. P120 retains host L120, parent Excel PID 100, child PowerShell PID 101 and the 09:00 UTC time. Process names alone do not prove malware or identify the human. Sam has approved temporary isolation of L120 in one case; the comparison has no such approval. Maya is the authenticated response operator. Nothing here executes PowerShell.
2. Request. The response service checks Maya’s role and the exact L120 approval before accepting an isolation command. The request gate enforces Maya’s response role, Sam’s approval, the isolate action and the exact L120 target. A displayed alert or recommendation cannot grant that authority. In the approved path it creates CMD120 in the delivery queue; L120 has not yet applied it. The comparison creates no command. This exercise assumes working operator authentication, a protected management channel and an online supported sensor.
3. Check host. L120 receives CMD120 and applies its local network filter. The later connectivity test has not run. Only the genuine queued command for this host may reach the modeled sensor. Receipt and local application are separate from accepting a request. The approved run applies its network filter and preserves its management-service exception; the comparison independently reads an unchanged host with no command. P120 and the original files remain. Isolation is not file removal, process termination, account revocation, complete remediation or proof that the device is safe.
4. Probe. A fresh selected app connection fails while management still works. Investigation and safe release remain unfinished. Independent probes test the selected app route and the retained management route after the host check. The approved filter blocks the app probe while management succeeds; without approval the app still responds. The service was reachable before either run, so this is a controlled comparison. This controlled exercise does not operate a live EDR product. Wider paths, earlier disclosure, investigation, business disruption and release from isolation need separate work. Other devices remain unchanged.

No Sam approval

1. Retain facts. P120 records Excel starting PowerShell on L120. AL120 is already under review. No isolation has been requested. This exercise begins after Dana reviews AL120 from L120’s online Windows sensor. P120 retains host L120, parent Excel PID 100, child PowerShell PID 101 and the 09:00 UTC time. Process names alone do not prove malware or identify the human. Sam has approved temporary isolation of L120 in one case; the comparison has no such approval. Maya is the authenticated response operator. Nothing here executes PowerShell.
2. Request. The response service refuses the isolation request because the exact L120 approval is missing. The request gate enforces Maya’s response role, Sam’s approval, the isolate action and the exact L120 target. A displayed alert or recommendation cannot grant that authority. In the approved path it creates CMD120 in the delivery queue; L120 has not yet applied it. The comparison creates no command. This exercise assumes working operator authentication, a protected management channel and an online supported sensor.
3. Check host. Independent host readback finds L120 unchanged. No command was queued or applied. Only the genuine queued command for this host may reach the modeled sensor. Receipt and local application are separate from accepting a request. The approved run applies its network filter and preserves its management-service exception; the comparison independently reads an unchanged host with no command. P120 and the original files remain. Isolation is not file removal, process termination, account revocation, complete remediation or proof that the device is safe.
4. Probe. The same selected app connection still reaches its service. Management works, but no isolation took place. Independent probes test the selected app route and the retained management route after the host check. The approved filter blocks the app probe while management succeeds; without approval the app still responds. The service was reachable before either run, so this is a controlled comparison. This controlled exercise does not operate a live EDR product. Wider paths, earlier disclosure, investigation, business disruption and release from isolation need separate work. Other devices remain unchanged.

This is one supported online host and two selected routes under controlled sensor/channel assumptions. Isolation preserves records and management access; it does not remove files, stop every process, disable an account or finish recovery. No approval leaves response open. Wider effects, investigation and safe release remain unfinished; vendor support and policy differ.

Flow references: Microsoft: endpoint telemetry and response · Microsoft: device isolation, permissions and pending actions