36. Active defense and containment
This guide describes Lawliet 1.5.13.s (the current release). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.
Active defense is operator-initiated containment: isolate a host, kill a process, block an address, quarantine a file, disable an account, force a password reset - and undo the reversible ones. "Nothing here runs on a schedule - every action is dispatched by a person and recorded." (The two exceptions are both explicit opt-ins: a playbook's containment step, which still needs a second signature, and a honeypot with auto-contain.)
Actions are sent to the agent as signed commands. The console says dispatched when the command is queued and shows the real outcome only when the agent reports it on its next check-in. A host without an active agent refuses delivery.
Active defense is a licensed module. If the licence no longer includes it, the Defense page shows Still in place on hosts - "Actions taken before this licence. Each can still be undone."
Permissions:
| Task | Permission | Four-eyes |
|---|---|---|
| See the page, the catalog and the history | View active defence | - |
| Dispatch an action, undo an action, run a command | Execute containment | yes - "Run a containment action" |
36.1 What the Defense page shows#
Path: Defense. The page title is Active defense.
- Engine: the state of the defense engine and a one-line detail.
- Dispatched and Failed ("Actions the agent could not complete").
- Automation: "No scheduler dispatches remediation on its own".
- Remediation actions: the catalog; "Select one to dispatch".
- The dispatch panel for the selected action ("No action selected" until you choose one).
- Run a command (36.5).
- Dispatched actions: Action, host, Parameters, Incident, Status, Completed, and an undo button for reversible actions.
36.2 The actions#
| Action | Linux | macOS | Windows | Undo |
|---|---|---|---|---|
| Isolate host | iptables default DROP | pf block all | Windows Firewall block inbound and outbound | Release isolation |
| Block address | iptables DROP rule | pf anchor rule | Windows Firewall rule, both directions | Unblock address |
| Kill process | SIGKILL | SIGKILL | TerminateProcess | - (cannot be undone) |
| Quarantine file | move + chmod 400 | move + chmod 400 | move + ACL to SYSTEM/Administrators | Restore file |
| Disable account | lock and expire the account | disable the user | net user /active:no | Enable account |
| Reset credentials | expire the password | require a new password | require a password change at next logon | - |
Isolate host keeps the agent's route to the Lawliet server open, so the host stays visible and can be released from the console. Everything else is cut off - including users' remote sessions and the applications the host serves.
An action an agent cannot perform fails loudly with "defence action not implemented on this agent: <action>". It is never reported as done.
36.3 Procedure: dispatch a containment action#
Permission: Execute containment. Four-eyes: yes.
Risk: containment interrupts users and services on the host (isolation cuts all traffic except to Lawliet; disabling an account logs a person out; killing a process loses its work). Rollback: the Undo button in Dispatched actions for isolate, block, disable and quarantine. Kill and reset cannot be undone.
- Open Defense and click the action in Remediation actions.
- Choose the Target host in Select a host....
- Fill the parameters the action needs (for example the IP address, the process name, the file path, the account). "Still needed: ..." lists what is missing.
- Optional: Incident reference (optional), for example
dlp-142. "Ties the action to the finding that prompted it." - Press Dispatch action.
- Four-eyes: type the reason and Send for approval. The approver signs in Approvals; you press Execute now (20.4).
What you see: the action in Dispatched actions with status dispatched, then completed or failed when the agent reports.
If it fails:
| What you see | Cause | Fix |
|---|---|---|
| Status stays dispatched | Agent offline | Check the host; the command is delivered when it returns |
| Failed, "not implemented on this agent" | The agent version lacks the action | Upgrade the agent (chapter 10) |
| Failed with a signature error | Agent and server keys disagree | See Agent security |
| Refused for a loopback or reserved address | Blocking it would cut the host off from itself | Block the real source address |
The same actions can be taken from a forensic case (Response tab, chapter 34), by playbooks (chapter 37), and - isolation only - with Isolate this host on a tamper or silence item in the review queue (chapter 21). Dispatched actions are kept as the record; they are undone, never deleted.
36.4 Procedure: undo an action#
Permission: Execute containment. Four-eyes: yes.
- In Dispatched actions, find the row and press Undo (<undo action>), for example Undo (release isolation).
- Confirm "<undo action> on <host>?".
- Complete the four-eyes request.
What you see: "<undo action> queued for <host>." The original row shows undone once the agent has reported.
36.5 Run a command (operator live response)#
Run a command sends exactly what you type to one host, run as the agent's user. "Unlike the actions above there is no stated blast radius and nothing to roll back." It is signed, timed out, and written to the audit trail with your name and your reason.
It is off by default. With it off the server refuses the request and the agents refuse the command type. To turn it on, an administrator sets DEFENSE_ALLOW_CUSTOM_COMMANDS=true in .env and runs sudo ./lawliet start (a restart does not re-read .env; see the CLI reference). Leave it off unless your incident-response procedure needs it.
Permission: Execute containment. Four-eyes: yes.
Risk: arbitrary code execution with the agent's privileges. Rollback: none.
- In Run a command, choose the Host and the Interpreter (sh, bash, powershell, cmd).
- Type the Command or script, for example
systemctl status sshd. - Type the Reason ("recorded in the audit trail").
- Press Review and run, read "Run this on <host>?", and press Yes, run it via <interpreter>.
- Complete the four-eyes request.
What you see: "Command dispatched." The host runs it on its next check-in, within a time limit (120 seconds by default). The audit trail holds the command text, your name and your reason.