# Host isolation

**URL:** <https://discuss.elastic.co/t/host-isolation/286745>\
**Category:** Elastic Security\
**Created:** [October 14, 2021, 2:59pm UTC](https://discuss.elastic.co/t/host-isolation/286745 "2021-10-14T14:59:00Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![wmacleodstrath](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@wmacleodstrath](https://discuss.elastic.co/u/wmacleodstrath)\
**Post date:** [October 14, 2021, 2:59pm UTC](https://discuss.elastic.co/t/host-isolation/286745/1 "2021-10-14T14:59:00Z")

</div>

7.14 - when I go to a case, with an alert on it , and click to get the fly out, I'm not seeing an option to "Take Action" and isolate a host. Do you only see the "Take Action" button if there is a certain alert in the case (e.g. a Malware alert - I currently have a "malware prevention alert".  
I also cant see "Take Action" when I go to Endpoints, but I think that might only be there in 7.15.  
Basically I'm wanting to test isolation. How can I do that?

Thanks community

Billy

---

<div class="post-metadata">

**Author:** ![caitlinbetz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/caitlinbetz/32/74246_2.png) [@caitlinbetz](https://discuss.elastic.co/u/caitlinbetz)\
**Post date:** [October 14, 2021, 3:50pm UTC](https://discuss.elastic.co/t/host-isolation/286745/2 "2021-10-14T15:50:56Z")

</div>

Hi @wmacleodstrath - thanks for using Elastic Security!

A couple initial questions for you -

- what is the OS of the host you are looking to perform this action on? for 7.14, [Host Isolation](https://www.elastic.co/guide/en/security/7.14/host-isolation-ov.html) will be available for Windows/MacOS hosts.
- what is your license level? Host Isolation will be available for Platinum / Enterprise licenses

---

<div class="post-metadata">

**Author:** ![wmacleodstrath](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@wmacleodstrath](https://discuss.elastic.co/u/wmacleodstrath)\
**Post date:** [October 14, 2021, 4:06pm UTC](https://discuss.elastic.co/t/host-isolation/286745/3 "2021-10-14T16:06:24Z")

</div>

Windows server 2016  
No license - I'm on the free on prem stuff. This article says it's free, open and limitless [Elastic Security 7.14: Limitless XDR protection | Elastic Blog](https://www.elastic.co/blog/whats-new-elastic-security-7-14-0) so I wouldn't expect i would need to purchase a license for it.

thanks

---

<div class="post-metadata">

**Author:** ![wmacleodstrath](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@wmacleodstrath](https://discuss.elastic.co/u/wmacleodstrath)\
**Post date:** [October 15, 2021, 10:22am UTC](https://discuss.elastic.co/t/host-isolation/286745/4 "2021-10-15T10:22:16Z")

</div>

FYI I'm also a Super User

---

<div class="post-metadata">

**Author:** ![wmacleodstrath](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@wmacleodstrath](https://discuss.elastic.co/u/wmacleodstrath)\
**Post date:** [October 15, 2021, 10:26am UTC](https://discuss.elastic.co/t/host-isolation/286745/5 "2021-10-15T10:26:31Z")

</div>

and if I go via Endpoint - I do see the "Take Action" button but my only choices are:  
view host details  
view agent policy  
view agent details  
reassign agent policy

---

<div class="post-metadata">

**Author:** ![wmacleodstrath](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@wmacleodstrath](https://discuss.elastic.co/u/wmacleodstrath)\
**Post date:** [October 15, 2021, 10:30am UTC](https://discuss.elastic.co/t/host-isolation/286745/6 "2021-10-15T10:30:15Z")

</div>

and if I look at the policy status I see "Successfully read host isolation configuration (disabled)"

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/eab2959de4ef78a028d08c1d4baf8973311949df.png)

---

<div class="post-metadata">

**Author:** ![robert.gleaden](https://avatars.discourse-cdn.com/v4/letter/r/f6c823/32.png) [@robert.gleaden](https://discuss.elastic.co/u/robert.gleaden)\
**Post date:** [October 15, 2021, 1:44pm UTC](https://discuss.elastic.co/t/host-isolation/286745/7 "2021-10-15T13:44:08Z")

</div>

I seem to be having the same issue aswell on v7.15.0

---

<div class="post-metadata">

**Author:** ![wmacleodstrath](https://avatars.discourse-cdn.com/v4/letter/w/8491ac/32.png) [@wmacleodstrath](https://discuss.elastic.co/u/wmacleodstrath)\
**Post date:** [October 18, 2021, 8:12am UTC](https://discuss.elastic.co/t/host-isolation/286745/8 "2021-10-18T08:12:09Z")

</div>

Thanks to @ [BenB196](https://discuss.elastic.co/u/BenB196) for pointing out (on another thread) that it does indeed look like a chargeable feature on this page [Subscriptions | Elastic Stack Products & Support | Elastic](https://www.elastic.co/subscriptions) despite many other pages referring to it as "free and open Limitless XDR"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 15, 2021, 8:12am UTC](https://discuss.elastic.co/t/host-isolation/286745/9 "2021-11-15T08:12:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
