50. Under Attack: suggestions, automatic start and the kill switch

An approved Under Attack plan can be started three ways: by hand, from a suggestion that Lawliet raises when detections point at an attack, or automatically when the plan allows it and the evidence is strong enough. This chapter covers the last two and the installation-wide kill switch that stops automatic starts.

Whatever starts a plan, the same safety net applies: the activation opens its confirm window, and if a second administrator does not confirm in time, everything it changed is rolled back by itself. An automatic start on a false positive therefore heals itself.

Permissions:

50.1 What Lawliet counts#

Three kinds of detection feed Under Attack. Nothing new runs on the hosts; Lawliet reads what its detections already recorded:

A detection an analyst closed as false positive in the review queue no longer counts (a decoy trip closed as resolved still counts: the decoy was touched). Sandbox (demo) detections only ever count for sandbox plans.

Which detections Lawliet trusts. A detection alert is placed on a host only through the agent that shipped its events (the agent signs in with its own token). The host name or address written inside a log line is never used: whoever sends syslog writes those. An alert no agent shipped - for example from a network device's syslog - still appears on a suggestion card, but it never counts towards an automatic start and adds nothing for spread. A decoy trip counts only when the agent that reports it is one the decoy is targeted at and planted on; any other report is kept, marked, and ignored. While SIEM-max of a running activation has raised rule severities by one level, those alerts are scored at the severity the rule had before; and an alert from a rule SIEM-max switched on or installed, or that fired only under a threshold SIEM-max lowered below the operator's own, shows on a card but never counts towards an automatic start.

50.2 The confidence score#

For each approved plan, Lawliet looks at the detections of the last 30 minutes (the window, 50.6) on the hosts the plan covers, and scores them from 0 to 100:

Repeats add nothing: one rule firing a thousand times scores as one rule.

Which hosts count. A whole-environment plan and a crown-jewels plan count detections from every host (an attack anywhere is a reason to protect everything, or tier-0 first). Any other plan counts only detections on its own hosts, including its never-touch hosts. A detection Lawliet cannot place on an enrolled host does not count for a segment plan.

Spent evidence. Detections from before the plan was last started (by anyone) or before its last suggestion was dismissed do not count again.

50.3 Suggestions#

When a plan allows suggested starts and a high or critical detection alert, a decoy touch or ransomware behaviour lands on its hosts, Lawliet raises a suggestion: one card per plan in the Review queue (module under_attack), updated as more detections arrive. The card shows the score, every signal behind it, and - if the plan also allows automatic starts - why it did not start by itself. A card that reaches the plan's threshold, or shows ransomware behaviour, becomes critical and notifies like any critical review item.

Procedure: start a plan from a suggestion#

You need: Start Under Attack.

1. Open the suggestion and read the signals and the plan it names.
2. Start it: POST /api/v1/under-attack/sources/suggestions/<id>/accept with the plan version shown on the card ({"plan_version": <n>}).

What you see: the activation is in its confirm window; a second administrator must confirm it. The card closes with the activation number.

If it fails: 409 "the plan changed since this suggestion was made" - someone edited the plan; review it, then start it from the plan itself. 409 "not approved" - the plan must be approved at its current version first.

Risk: the plan's changes start at once. Rollback: withdraw it (you started it), let the confirm window lapse, or end it with a second administrator.

Procedure: dismiss a suggestion#

POST /api/v1/under-attack/sources/suggestions/<id>/dismiss with {"reason": "<why>"}; add "false_positive": true to file it as a false positive. A reason is required. The detections it showed no longer count for that plan, for suggestions or for automatic starts; only new ones raise a new card. Lawliet keeps its own record of each dismissal (who, when, why).

A suggestion card is started or dismissed only here: the review queue's generic status, resolve, accept-risk and suppress actions refuse it (409). A card that closes because its plan was retired or changed does not spend the evidence.

50.4 Automatic start#

A plan starts automatically only when every one of these holds:

1. The plan is approved at its current version and allows automatic starts.
2. At least two independent, trusted signals (50.1) of medium weight or more are behind the score. A single rule never starts Under Attack by itself, however loud it is.
3. The score over trusted signals reaches the plan's threshold (50 to 100; 90 unless the plan sets another). The card also shows the score over every signal.
4. The kill switch is off - and readable: if the Under Attack settings or this module's settings (50.6) cannot be read, Lawliet treats automatic starts as switched off.
5. The plan's previous automatic start was not rolled back for lack of confirmation in the last 24 hours (50.6). A false positive does not repeat itself every hour.
6. The installation has not already started 2 automatic activations in the last hour (50.6).
7. The trusted signals come from at least two observers that cannot be the same: two different agents, or an agent and Lawliet itself. Everything one agent reports about itself - its ransomware report and a decoy on the same host - is one observer. A canary hit counts as the agents its token was planted on, and as the agent whose address sent the request; only a server-hosted canary hit from an address that is not an agent is Lawliet's own observation. One observer raises a card.
8. The plan is not already active.

Evidence is counted per plan, so the same detections can start two different automatic plans (within the hourly limit). When 4 to 8 stop a start that would otherwise have happened, the plan gets a suggestion card instead (if it allows a manual or suggested start) saying which one, and the audit log records it. An automatic start has no starter; the activation records the score and every signal behind it, and opens the confirm window like any other start.

To see what the next evaluation would decide for every plan - score, breakdown, signals, and the condition that holds it back - read GET /api/v1/under-attack/sources/status. Lawliet evaluates every 15 seconds.

50.5 The kill switch#

The kill switch stops automatic starts across the whole installation. It does not stop suggestions, and it does not touch activations already running (ending one always takes two administrators).

Procedure: switch automatic starts off#

POST /api/v1/under-attack/sources/kill-switch/engage, optionally with {"reason": "..."}. One person, effective at once.

Procedure: switch automatic starts back on#

POST /api/v1/under-attack/sources/kill-switch/release. A second administrator must approve (critical action "Approve an Under Attack plan", when dual control is on - see chapter 15; with it off, one signature is enough, as for every critical action). If the settings cannot be read, release is refused until they are repaired; engaging the switch on damaged settings rewrites them with the shipped defaults and the switch on.

50.6 Settings#

GET /api/v1/under-attack/sources/settings and PUT (four-eyes):

A damaged settings row (not readable, or a value missing) holds automatic starts until the settings are saved again; suggestions go on with the defaults.

The per-plan threshold and whether a plan allows suggested and automatic starts are part of the plan and are approved with it. Evaluation runs on one server worker at a time.