51. Under Attack in the console: plans, the war room, drills and ending

Under Attack is a prepared response for an attack in progress. A plan names a scope (the whole environment, host groups, an AD organisational unit, subnets, tags, chosen hosts, or the crown jewels first) and runs in Baseline mode: the business keeps running while every hardening control whose guards say it is safe is applied at once on the hosts in scope, without the audit stage, each with its exact rollback (chapter 49).

Plans are prepared and approved in calm conditions and rehearsed with a drill. In an incident one administrator starts the plan at once (break glass); a second, different administrator must confirm it within the confirm window or every change rolls back by itself. Ending it takes two administrators and lets them keep or exactly roll back each change. A plan can also be started from a suggestion raised by detections, or start by itself on a multi-signal score: how Lawliet counts and scores detections, and when it may start a plan alone, is in chapter 50; the console side is 51.9.

The console screens are under Investigation > Under attack. How plans, the change ledger and the guardrails work is in chapter 48; what Baseline puts on a host is in chapter 49.

Permissions:

51.1 Prepare a plan#

You need: Prepare Under Attack plans.

1. Open Under attack and click New plan.
2. Give it a name. The mode is Baseline.
3. Under Scope, choose what it covers. For chosen hosts, tick them in the list. Domain controllers and the tier-0 list are protected: disruptive changes are refused on them unless you tick Include domain controllers or Include the tier-0 list. Add hosts or host groups the plan must never touch.
4. Under What the agents do, choose Isolate a host on a critical detection (within the blast-radius cap), Raise telemetry to maximum and SIEM to maximum.
5. Under Guardrails, set the confirm window and the blast-radius cap and its window - or leave them empty for the installation defaults (51.8).
6. Under Who hears about it, choose the console banner, the wall banner and SIEM forwarding.
7. Under How it may start, choose manual start, suggestions from detections, and automatic start (with its confidence threshold; a single rule never starts a plan).
8. Click Save.

What you see: the plan page, with the status draft. A mistake is shown at its field and nothing is sent until it is fixed.

If it fails: the server's refusal is shown above the form - for example an unknown host group.

51.2 Approve a plan (arm it)#

You need: Prepare Under Attack plans, and a second administrator when dual control is on.

1. Open the plan and click Approve, then Approve again in the confirmation.

What you see: the status armed. Only an armed plan can be started.

The approval is of the version you read: if somebody saved the plan after you opened it, the approval is refused and you read it again. Saving an approved plan bumps its version and disarms it - the page says Edited since it was approved - until it is approved again. A drill still works on a disarmed plan.

51.3 Rehearse a plan (drill)#

You need: Prepare Under Attack plans.

1. On the plan, or in the plan list, click Drill. Save first (after a save the form shows what the server stored, so the buttons work at once): with unsaved edits on screen, Drill and Approve are disabled, because both act on the saved version.

What you see: the drill review. It lists every change a real activation would make, grouped by host and connector, what the guards would refuse and why (never-touch, protected host, outside the scope, blast-radius cap), the controls that would be applied without telemetry behind them, and the scope as it was resolved. The page says Nothing was sent to any host or connector.

2. When you have read it, click Reviewed: close the drill. It stays in the history, and the plan list shows the date of each plan's last drill.

If it fails: if a drill ever shows a change that is not a prediction, the page says so in red instead of calling it a rehearsal. Report it before relying on the plan.

51.4 Start a plan (break glass)#

You need: Start Under Attack. The plan must be armed and allow manual start.

1. In the plan list, click Activate on the plan.
2. Read the confirmation: the mode, the scope, and how long a second administrator has to confirm. Click Start baseline.

What you see: the war room (51.5). The activation starts at once; its changes are recorded and sent while the confirm window runs.

Risk: the plan acts on every host in its scope at once. Rollback: withdraw your start (51.5), or let the confirm window run out with nobody confirming: every change is rolled back automatically.

51.5 The war room#

Open it from the red strip at the top of every console page, from Under attack, or from the overview. It refreshes itself.

• Second administrator - while unconfirmed, the countdown to the automatic rollback. The countdown is counted from the server's figure, not this computer's clock. A different administrator clicks Confirm activation; the administrator who started it sees why they cannot, and may Withdraw my start instead (a manual start only), which rolls everything back now. Once confirmed, the activation stays in force until two administrators end it.
• Blast radius - automatic containment (isolating a host) in the cap's window, against the cap. Ransomware and honeypot triggers are not counted. When the cap is reached, automatic containment waits for a person; a plan manager can raise the cap (Release, second signature).
• Ending it - see 51.6.
• Live timeline - detections, every status each change reached (for example pending -> failed, on one line per change), auto-response playbook steps and the activation's own marks (started, confirmed, ending), newest first. It refreshes every 10 seconds without skipping or repeating anything. Detections are shown only to a role that may search logs.
• Attack chain since it started - the ATT&CK tactics and techniques of the detections since the activation started, in matrix order, with how often each fired and on which hosts.
• Scope - the hosts in scope, frozen when it started, and the hosts it never touches, with the reason.
• What changed - every change, grouped by host or connector, with its status. Controls applied without evidence (no telemetry showed them safe) are listed first and flagged: they are the first suspects when a business application breaks. Roll back on a change undoes only that change while the activation stays live (second signature).

51.6 End an activation (two administrators)#

You need: End Under Attack, for two different administrators.

1. In the war room, click Review changes and end.
2. For each applied change, choose Keep or Roll back. Rollback is the default. A change still pending (sent, no result yet) has no choice: it shows will be rolled back / withdrawn, because only an applied change can be kept. Changes that already failed, were refused or were rolled back show their status. The screen loads every change; if any did not load it says Showing N of M and will not let the end be asked for or confirmed.
3. Click Ask to end and confirm.
4. A second administrator opens the same screen, reads the decisions (they are read-only now) and clicks Confirm and end. The confirmation carries what they were shown: if the decisions changed in between, it is refused and they read them again.

What you see: the activation shows Ending while SIEM rules, playbooks and telemetry are restored (always first, whatever is kept) and each change is kept or rolled back, then Ended: the record of every change and how it finished.

If it fails: a rollback that fails is shown as rollback failed and raised in the review queue; the change is still in place on its target. The administrator who asked can Withdraw the request to change the decisions; the activation stays live.

51.7 The wall and the console banner#

While an activation is live:

• every console page carries a red strip naming the mode, the plan, the hosts in scope and, while unconfirmed, the countdown, with a link to the war room;
• the operations wall (Overview > Wall mode) is taken over by a full-screen banner: the mode, the plan, the hosts in scope, when it started, the changes applied, and either the countdown or Confirmed by a second administrator.

A plan can switch either off under Who hears about it. A drill never raises them. Users without View Under Attack do not see them.

51.8 Installation settings#

You need: Prepare Under Attack plans; a second administrator to save.

On Under attack, click Settings.

• Defaults for the confirm window (5-240 minutes, default 60) and the blast-radius cap and window. A plan's empty field takes these.
• Never touch - three lists of host ids and host groups: the Lawliet server, tier 0, and the operator list. Only listed members count: a host cannot put itself on a list through its own tags. If the lists cannot be read, the screen says so and cannot be saved (saving would overwrite them).

The automatic-start kill switch is not on this screen: it is in Automatic start (51.9). A save here never changes it, even if somebody switched automatic start off after you opened the form.

51.9 Suggestions, automatic start and the kill switch in the console#

How suggestions are raised, how the confidence score is built and every condition automatic start needs are in chapter 50. In the console:

Suggestions#

Open suggestions appear on Under attack under Suggested by detections, and the first two on the overview. Each card names the plan and its mode, the confidence score against the plan's threshold, every signal behind it (with its weight and how many hosts), the ATT&CK tactics, and - when the plan allows automatic start - why it did not start by itself.

You need: Start Under Attack to start or dismiss.

1. To start the plan, click Start the plan and confirm. It is the same break-glass start as 51.4, at the plan version the card showed: if the plan was edited since, the start is refused and you review the plan first. The war room opens.
2. To dismiss, click Dismiss, say why (required) and optionally File it as a false positive. What the card showed stops counting for that plan; only new detections raise a new card.

A card for a plan that cannot be started from a suggestion (not approved, or allowing neither suggested nor manual start) says so instead of offering Start the plan.

Automatic start and the kill switch#

Under attack > Automatic start shows the kill switch and, for every approved plan, the score the next evaluation would see and what holds automatic start back (switched off, below threshold, a single detection, held after an unconfirmed start, the hourly cap, or not allowed by the plan).

• Switch automatic start off - one person, at once, with an optional reason. Anyone with Start Under Attack, Confirm Under Attack or Prepare Under Attack plans may do it. Suggestions, manual starts and running activations are not affected.
• If the automatic-start settings are incomplete or damaged, the panel says Automatic start is held: settings are incomplete. Review and save the settings to enable it. Automatic start stays off until a plan manager saves them (second signature); suggestions still work.
• Allow automatic start - Prepare Under Attack plans and a second signature. If the settings cannot be read, the switch shows off (settings unreadable) and cannot be released until they are repaired.
• Automatic-start settings (plan managers, second signature): the score window, the most automatic starts per hour, and how long automatic start is held after an unconfirmed one rolled back (50.6).