MITRE ATT&CK is a globally accessible knowledge base that catalogs adversarial tactics and techniques based on real-world observations. According to SCAZT Section 6: Threat Response (Page
113), this framework enables security professionals to map and anticipate adversarial behavior throughout the attack lifecycle. It supports threat modeling, detection engineering, and incident response.
Reference: Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT), Section 6, Page 113

In Cisco Secure Endpoint (formerly AMP for Endpoints), isolating an infected machine is the most immediate action to contain the threat. Isolation cuts the endpoint off from all network communication except to the management console, allowing the analyst to investigate further while preventing lateral movement or data exfiltration.
According to SCAZT Section 6: Threat Response (Pages 114-117), isolation is a recommended first response in the event of malware detection.
Reference: Designing and Implementing Secure Cloud Access for Users and Endpoints (SCAZT), Section 6, Pages 114-117