You can lock an infected or potentially infected device to stop command and control activity, the exfiltration of data, and the lateral movement of malware.
Full lockdown allows you to disable the device's LAN and Wi-Fi network capabilities and prevent all communication between the device and the CylanceOPTICS cloud services for up to 96 hours.
Partial lockdown disables the device's LAN and Wi-Fi network capabilities and retains communication with the CylanceOPTICS cloud services, allowing CylanceOPTICS to continue to receive detections and sensor data. Partial lockdown persists indefinitely and is available with the CylanceOPTICS agent version 3.1 or later for Windows.
1. Click CylanceOPTICS > Devices
Find the device that you want to lock.
2. To fully lock a device, select Action > Lockdown Device
If it’s a Windows device, in the drop-down list, click Full Lockdown.
3. For full lockdown, choose a lockdown period and click Confirm Lockdown
The lockdown will end when the lockdown period expires. To unlock before the period expires, you can use an unlock key.
4. To partially lock a device, click the device name and choose the Lockdown action
5. In the drop-down list, click Partial Lockdown and confirm
Partial lockdown is available only for Windows devices with Optics agent 3.1 or later. A partial lockdown continues until you unlock the device.
6. To unlock a partially locked device, click the device and choose the Unlock device action
7. Click Confirm Unlock
8. To manually unlock a device before the lockdown period ends, use an unlock key.
For more information, see step 3.
To learn more about managing devices using CylanceOPTICS, see the Cylance Endpoint Security Administration Guide.