Lock a device
You can lockdown an infected or potentially infected device to stop command and control activity, the exfiltration of data, and the lateral movement of malware.
You have the following lockdown options:
|
Lockdown type |
Description |
|---|---|
|
Full lockdown (all platforms) |
Prevent all network communication from the device. You can lock a device for up to 96 hours. You can use an unlock key to unlock the device before the end of the lockdown period. For more information about unlocking a device, see Unlock a device. |
|
Partial lockdown (Aurora Focus agent 3.1 or later for Windows only) |
Disable the device's LAN and Wi-Fi network capabilities and retain communication with the Aurora Focus cloud services, allowing Aurora Focus to continue to receive detections and sensor data. Partial lockdown persists indefinitely. You can unlock the device at any time using an unlock key or the remote unlock feature. For more information about unlocking a device, see Unlock a device. |
|
Customized partial lockdown (Aurora Focus agent 3.2.1140 or later for Windows only) |
This option is the same as partial lockdown but also allows you to specify additional communication channels that you want to allow during a partial lockdown. |