An EDR rule auto-quarantines hosts in a live intrusion you are still scoping. How do you quiet it without going blind?

## Why this question is asked Automated response is a control that an adversary can trip on purpose, and it is also a control that can announce your investigation before you are ready. Interviewers use this scenario to see whether a candidate understands that a detection rule has at least three separable parts — the logic over records, the alert it raises, and the action it executes — and whether they can change one without losing the others. ## What the quarantine actually reveals An automated isolation is not a quiet act. From the adversary's side, a session dies mid-command and does not come back; from the estate's side, a laptop drops off the network, its user calls the service desk, and a ticket appears in a system that may itself be readable by the intruder. If the operator holds a second foothold elsewhere — a dormant mail rule, an implant in an edge device — the isolation of one host is exactly the partial cut that teaches them what you have found and where to move. ## The change to make 1. **Alert-only, not off.** Keep the rule evaluating and raising alerts; disable only the response action. The rule is producing the scope you are still building. Turning it off blinds the investigation and removes records you will later need to show when each host was first touched. 2. **Scope the suppression narrowly.** Suppress the action for the rule, or for the specific hosts in the incident, rather than switching the platform's response engine off globally. A broad suppression protects the adversary you already know about and every unrelated one you do not. 3. **Cover the gap with a human.** The action existed because nobody wanted to wait for an analyst. Removing it means a genuine new detection sits unactioned. Name the person or the on-shift role covering the queue and the criterion that overrides the suppression — if a host starts encrypting files, you isolate it and accept the tip-off. 4. **Time-box it and bind it to T-0.** The suppression expires at the planned cut. Put the re-enable step in the containment runbook as an explicit line item with an owner, because a suppression that outlives the incident is a permanently weakened control that nobody remembers creating. 5. **Record it.** Who asked, who approved, the window, the rule id, and the reason. This lands in the case file and in the post-incident review, and it is what stops the change from reading later like an insider action. 6. **Check the blast radius of the change itself.** Response actions are often chained: a quarantine may be what creates the ticket, notifies the owner, or triggers evidence collection. Suppressing the isolation can silently suppress the collection you were relying on. ## The judgment underneath The suppression is only defensible because it is temporary and paired with a plan to cut. If there is no cut date, you are not being quiet, you are leaving an automated defence off indefinitely for an adversary who is still working. Equally, if damage is accruing now — data leaving, files being encrypted — the tip-off cost is the cheaper of the two, and you let the action fire. ## What a strong answer adds A strong candidate names one more thing: verify the change took effect the way they think it did. A rule set to alert-only in the console may still be executing an action through a different playbook, and the only way to know is to observe a hit and confirm nothing happened to the host. That is a small verification, and it is the difference between believing you are quiet and being quiet. ## Distinguishing the two failure modes - Disabling the rule: you go blind, the case stops growing, and you may not be able to reconstruct which hosts were touched. - Leaving the action on: you contain one host loudly, in the middle of an incomplete picture, and hand the adversary the information that they are being hunted. Both are wrong, and the reason interviewers like the question is that the correct answer is a third option a surprising number of candidates never reach for.