THE FIELD GUIDE / SECURITY & RESPONSE
Known & unknown malware response
Investigate malware with or without a signature or CVE, then act within an explicitly enabled policy.
Combine known and behavioral detection
Maintained ClamAV signatures, authenticated YARA rules and trusted indicators identify known threats. AI-assisted triage correlates process ancestry, suspicious file changes, persistence, package/vendor discrepancies, service activity and available network/log evidence to investigate previously unknown behavior. Neither a known hash nor a CVE is required to open an investigation.
Explain the classification
Findings retain evidence-linked classification, confidence, explanation, competing benign explanations and recommended actions bound to server, observed file/process identities, evidence revision and model version. Suspected behavior, confirmed malicious activity and unknown/incomplete results stay distinct. Logs and endpoint strings are untrusted inputs; validated output types never become arbitrary shell commands.
Choose the response policy
Server/group policy chooses monitor-only operation or scoped automatic quarantine and termination, with exclusions and evidence/confidence thresholds. Qualifying known-malware or corroborated unknown-malware findings can trigger both file quarantine and verified associated-process termination where applicable, without a fresh approval for each incident. A bare model verdict, unfamiliar binary or custom startup entry alone is not sufficient authority.
Record each actual outcome
Identity-checked executors recheck current policy, preserve evidence where feasible, suppress duplicates and record recovery information. Track related processes and persistence only within the selected scope, report recurrence and escalate ambiguous or unsupported/fileless activity.
Continue through pause and patching
Known-malware scans and deterministic behavioral detection/response continue with AI paused or unavailable. Missing AI investigation coverage stays explicit, with evidence retained for later eligible triage. Protection is not tied to an active CVE window and continues after patch installation.
Review and recover
Server/fleet incident views show known versus AI-discovered findings, evidence, coverage, policy and individual action outcomes. Significant findings feed the live notification center. False-positive restoration, artifact release and affected-service restart require their own recovery review and preserve custody/audit history.
Open the application reference for capability scope and technical details.
Open Open SECURITY_IMPLEMENTATION.md on GitHub ↗