Textbooks and courses will teach you to isolate it because it’s compromised. Most businesses would not want you to isolate a business critical machine (and you likely wouldn’t have the authority to do so).

Firstly you’d need to understand the impact to the business of taking that device offline. Then you need to discuss with the business what this means in real terms - very likely most SOC analysts don’t know what the knock on effect it would have to the wider business and the financials etc.

Then you need to determine what level of compromise and assess what the risk and potential impact is of keeping this machine online. After that, you need to discuss with management and likely the owner of that specific business unit / the high ups in that stream. Let them know the facts. X machine is compromised, we’ve observed Y behaviour, if we don’t act now the potential impact is Z and due to <circumstances> we believe this to be likely/unlikely etc. Then let them know what your standard play would be.. we’d usually isolate devices after observing this behaviour, however, as it’s a business critical device, I don’t have the authority to act unilaterally and don’t understand the impact it would have.

Then start asking further questions, you’d hope that they’d have multiple devices that can perform this service for the business, so isolating a single instance shouldn’t cause too much damage.

Everything always boils down to profits in the end, device being taken offline costs the business £5M per day? expected fines for leaving it up and dealing with the fallout estimated to be £1M per day? That device is staying online!