Difference between Security heartbeat isolation and device isolation feature in threat protection policy?

Question

What is the purpose of having device isolation using Sophos XG firewall heartbeat when there already exists device isolation in the threat prevention policy which does not even need Sophos XG ? What is the the difference between these two types of isolation, any particular advantage of one over the other?

This thread was automatically locked due to age.

RichardP · Accepted Answer

The best way to think of it is like this: 
 The SFOS can be configured to prevent access to other subnets and to the outside world based on the endpoint's health (GREEN, YELLOW, or RED) - transmitted through the heartbeat. 
 The Endpoint can be configured to isolate itself if it goes to RED Health - this prevents communication within the subnet and to the outside world to stop lateral movement and communication back to CnC servers. 
 There is overlap between the two elements but they work together to enhance the entire security posture. We offer them in tandem to allow this protection to customers who only buy one product but they can get further enhanced security by combining the two products. 
 In general, Endpoint Isolation is faster - it triggers as soon as the health state changes by injecting into the Windows Firewall rules limiting all access except to Sophos Central and to any excluded IP addresses configured in the policy. 
 The SFOS firewall rules allow for greater granularity and can be based on destination Health level (never set that for rules going out of the network - nothing on the internet will have a Health status in your SFOS) so can be used to allow limited access to hosts as needed. It can also trigger on YELLOW health instead of just RED. 
 To add to it - there is also the stonewall mechanic where the SFOS can transmit a list of blacklisted IPs (based on their RED HEALTH) to all the other managed endpoints and they will block incoming traffic from those hosts at their NIC. 
 There are further products coming out to help enhance the internal network security at each node in the near future. 
 I hope this helps.