Endpoint isolation

Cutting a machine off the network stops the spread while keeping the machine intact for analysis.

It is a much better first move than powering it down, which destroys everything in memory. Most endpoint tooling can do it remotely and instantly, which is one of the strongest arguments for having such tooling at all.