48. Under Attack mode
This guide describes Lawliet 1.5.14.s (the current release). Screens, commands and procedures may change in later versions; the usage guide is updated with each release. Check the version your server runs under Settings > Platform or with ./lawliet version, and see the Releases page for what changed.
Under Attack is one prepared switch for the moment an attack is under way. A plan names a scope (the whole environment, a host group, an AD OU, subnets, tags, chosen hosts, or the crown jewels) and runs in BASELINE mode: the business keeps running while every hardening control the planner says is safe is applied at once on the hosts in scope, without the audit stage, each with its exact rollback (chapter 49). Two administrators approve a plan once; in an incident one administrator starts it, and a second must confirm it or everything rolls back by itself.
This chapter covers the core: plans, activation, the confirmation window, the change ledger, the guardrails and ending. The console screens (plans, war room, drills, exit review) are in chapter 51; suggestions and the automatic start in chapter 50.
Permissions:
| Task | Permission | Four-eyes |
|---|---|---|
| See plans, activations, every change, settings | View Under Attack | - |
| Create, edit and drill a draft plan; create the built-in plans | Prepare Under Attack plans | no (a draft plan does nothing) |
| Edit or retire an approved plan (either de-arms it) | Prepare Under Attack plans | yes - "Approve an Under Attack plan" |
| Approve a plan | Prepare Under Attack plans | always two people: not the plan's last editor, or a dual-control co-signer; plus the critical action "Approve an Under Attack plan" |
| Change the never-touch list or the defaults; lift a held blast-radius cap | Prepare Under Attack plans | yes - "Approve an Under Attack plan" |
| Start an approved plan (break-glass) | Start Under Attack | no - a second administrator confirms afterwards |
| Confirm an activation | Confirm Under Attack | the confirmer is never the starter |
| End an activation | End Under Attack | always two administrators (request + confirm) |
| Roll back one change while still active | End Under Attack | yes - "Roll back an Under Attack change early" |
48.1 Plans#
A plan is inert until it is started. It holds:
- Scope - who is in it. Host groups count their listed hosts and hosts carrying the group's tags (a tag can only widen protection). An OU is resolved from the latest complete AD collection. Crown jewels is the domain controllers plus the tier-0 list (48.5).
- Mode - BASELINE.
- Options - confirmation window (default 60 min), blast-radius cap (default 5 automatic containments per 15 min), never-touch additions, categories the plan explicitly includes (
domain_controller,tier0), whether the console and wall banners show it, and:- SIEM max - every detection rule on and sharper while the activation is live, restored exactly at the end (31.7);
- auto-response - containment playbook steps on hosts in scope run at once through the activation (37);
- isolate a host on a critical detection (counted against the blast-radius cap).
Maximum telemetry is not available in this release: no agent in this build raises its telemetry on request, so the console does not offer the switch and the server refuses a plan that turns it on. A plan saved earlier with it on keeps working; the switch is treated as off (the plan editor says so and turns it off at the next save) and nothing is sent to the hosts (45).
- Activation sources - manual, auto-suggest, automatic (off by default).
Any edit of an approved plan returns it to draft: what two people approved is exactly what runs.
Built-in plans. Lawliet creates two drafts: Default: Baseline - whole environment and Default: Crown jewels first. Review one, save it, and have a second administrator approve it; or approve it through dual control. Nobody can approve a built-in plan alone.
Drill. Drill runs the plan exactly as it would run - the same guards, the same ledger - and records every change as planned. Nothing reaches a host or a connector. A draft plan can be drilled. Close the drill when you have read it.
48.2 Starting: break-glass and the confirmation window#
One administrator with Start Under Attack starts an approved plan. Directives begin at once. A second, different administrator must Confirm within the plan's window. If nobody does, the activation rolls itself back: every change is undone exactly. A single administrator - or a compromised account - cannot hold the fleet.
The administrator who started a plan by hand may Withdraw it while it is unconfirmed; that is the same rollback the deadline would do. An automatic activation is confirmed by any one administrator.
Restart cool-down. After an activation you started rolled back unconfirmed (or you withdrew it), any start of yours - on any plan - needs a second administrator's signature (dual control) for 24 hours, or until another administrator has confirmed or co-signed a start of yours; another administrator may also start it. One person cannot hold the fleet by starting again every window.
The Lawliet server. The server's own agent must be pinned under never-touch (Lawliet server), or two administrators confirm there that no agent runs on the server. Until one of the two is saved (four-eyes), a plan cannot be approved or started; a drill still runs. Lawliet proposes candidates - agents reporting the server's address or host name - in the scope preview and the drill, but a candidate is never protected: an agent reports its own address and name, and a compromised host must not be able to shield itself by claiming to be the server. Pin the real one.
Automatic activation needs a confidence score at or above the plan's threshold and at least two independent detections of medium severity or above; one rule never starts it. The installation kill switch stops all automatic activation (Under Attack > Sources); an unreadable setting counts as engaged.
48.3 The change ledger#
Every directive is one ledger row, written before anything leaves the server:
| Status | Meaning |
|---|---|
| planned | drill only |
| refused | a guardrail refused it; the reason is shown (48.5) |
| pending | issued, no confirmation yet |
| applied | the host or connector confirmed it |
| failed | it was refused by the target, or never arrived |
| reverting / reverted | the undo was issued / confirmed |
| revert_failed | the undo failed - raised in the review queue (high) |
| kept | an administrator chose to keep it at exit |
| irreversible | nothing to undo (a killed process, a forensic snapshot) |
| superseded | a newer activation took this host over |
Host changes travel as the hardening executor's signed agent commands, so nothing new is trusted. A host reports per change what it applied. A change is never shown as applied, or rolled back, without the target's confirmation. A change whose result can no longer arrive (the server stopped between recording it and sending it, or a host took a command and never answered) is shown failed with outcome unknown - verify and raised in the review queue; if the activation is ending, its undo is sent anyway. Changes marked applied without evidence (a control with no telemetry behind it) are the first rollback candidates.
48.4 Ending#
- An administrator with End Under Attack opens the exit review and chooses, per change, keep or roll back (default: roll back).
- A second, different administrator confirms the same choices. If the first changes them, the second must read them again.
- SIEM and playbook settings are restored first, then every change is kept or undone. The activation ends when every change has settled.
To roll one change back while the activation is still active (a business application broke), use Roll back on that change (four-eyes).
48.5 Guardrails#
- Never touch. Settings > Never-touch lists: the Lawliet server's own agents, tier-0 hosts, and an operator list - agent ids or host groups (listed hosts only; tags never exempt a host). The Lawliet server and the operator list are never touched by any directive. Domain controllers and tier-0 hosts are protected from automatic disruption unless the plan includes their category; an administrator acting by hand still can. A host that claims to be a domain controller is checked against the latest AD collection: one the collection says is not a DC is not protected, and the scope notes say so. An unreadable never-touch list stops activations until it is fixed.
- Blast-radius cap. Automatic containment is counted per window. At the cap the activation holds further automatic containment for a human until two people lift the cap. Ransomware behaviour and decoy touches are exempt. A directive a person issued is never capped.
- Sandbox. A sandbox activation only reaches sandbox hosts and never sends anything.
48.6 API#
Prefix /api/v1/under-attack: plans (POST plans/defaults, plans/{id}/approve, /drill, /activate, /retire, /scope), activations (/{id}/confirm, /withdraw, /end, /end/confirm, /close-drill, /changes, /changes/{change_id}/revert, /release-cap), settings, capabilities; suggestions and the automatic start under sources (chapter 50).