THE FIELD GUIDE / SECURITY & RESPONSE
Reviewed response & remediation
Preserve, contain, repair and verify through separate approvals.
Preserve before changing
Review a detection and preserve selected evidence in the target vault. Acquire a controller copy through a separate approval. Custody records bind paths, hashes, identities and evidence revisions. Export the portable response record for independent retention.
Contain deliberately
Use separately approved file quarantine and original-file restoration, selected executable-process suspension and recovery, service pauses and cloud isolation. Keep response pauses separate so releasing one does not silently release another.
Repair and validate
Prepare authenticated replacements read-only, approve private staging and separately approve no-overwrite live publication. Reviewed service restart and rollback, typed remediation, credential-rotation tasks and rebuild escalation use explicit validation and recovery paths.
Policy-authorized automatic containment
For confirmed CVE exploitation or qualifying malware findings, administrators can enable a bounded automatic-response policy per server, CVE or applicable policy group. Quarantine and process termination then execute within the selected scope without a new approval for every incident. Monitor-only mode, action exclusions, fresh identity checks and durable recovery records retain control. AI output alone never authorizes these actions. Explore exposure-window monitoring and automatic containment.
General malware response
Known-malware detections and corroborated AI-assisted behavioral findings can enter the same scoped response pipeline without an active CVE exposure window. Quarantine, termination and persistence recovery remain distinct actions with independent outcomes. Explore known and unknown malware workflows.
Keep watching
Recurring retained-response verification and service watches report failed, unavailable or overdue checks. Compare healthy baselines before deciding whether to release a pause. AI proposals never substitute for operational authorization.
Open the application reference for capability scope and technical details.
Open Open SECURITY_IMPLEMENTATION.md on GitHub ↗