Containment

[alevere]

I would like to see an option for containing the device to permitted network services alone.
In this section: Type: Device-Containment (Enumerated)

Our EDR contains a host using a software network shim that limits communication to the EDR system.
Optionally, we could allow another host or two such as a patch server.
This would not fall under port isolation or app execution.
I dont think we need to express the permitted services, that is backend config on EDR.

[MartinEvandt]

@alevere, I think this issue should be addressed in the linked PR, could you confirm?

From the examples section:

A.1.X Network isolate an endpoint, but allow communication with selected IP and domain name addresses

{
  "action": "contain",
  "target": {
    "device": {
      "hostname": "DESKTOP-123ABC"
    }
  },
  "args": {
    "edr": {
      "device_containment":"network_isolation",
      "permitted_addresses": {
        "ipv_net": ["192.168.0.255"],
        "domain_name": ["support.organization.tld", "wiki.organization.tld"]
      }
    }
   },
  "actuator": {
    "edr": {}
  }
}

[alevere]

That example looks great to me.