A transit fusion center runs Sentinel playbooks that isolate hybrid-joined devices only after dual control. What containment pattern is that?

Running Sentinel playbooks that isolate hybrid-joined devices only after dual control is containment with affirmative human gates for civic endpoints. Isolation (network contain via Defender for Endpoint or similar) is high-impact: it can take a fare-system laptop or ops workstation offline. Dual control—two authorized approvers or an approver plus automated high-confidence criteria—reduces mistaken isolation from noisy alerts while still enabling rapid response once approval is recorded. Transit fusion centers cannot risk losing their own infrastructure because a Sentinel rule misfired.

Sentinel playbook containment of civic endpoints that requires single-admin approval before isolation misses the dual-control gate, so a single admin acting alone does not satisfy the two-approver requirement for isolating hybrid-joined devices. Sentinel playbook containment of civic endpoints that requires dual-control approval after isolation gets the timing wrong, so approving after isolation does not provide an affirmative human gate before hybrid-joined devices are taken offline. Sentinel playbook containment of civic endpoints that requires dual-control notification before isolation lacks an approval gate, so merely notifying reviewers does not require dual-control approval before isolating hybrid-joined civic devices. Dual-control approval—human review plus another human or strong automated criteria—ensures that isolation decisions during crisis are intentional, not automatic side effects of tuning.

Exam caveat: Isolation speed and protection must be balanced. Prefer playbooks that offer SOC leads rapid approval buttons (one-click dual-control) rather than workflow delays, or that automate isolation only when two independent detections agree.

Operational check: Scope isolation playbooks to hybrid-joined civic endpoints and fare systems; configure them to require dual approval (e.g., SOC lead + CISO automation rule, or two distinct approvers); build test cases with known benign signals and confirm the playbook requires approval before isolation; and measure approval latency so containment can still happen within SLA.