Remediation
Response actions on the endpoint: kill a process, quarantine a file, isolate the host
from the network. An action runs only from a verified signed Command or an
autonomous local verdict, and every action is audited.
Sequence
Actions
| Action | Module | What it does |
|---|---|---|
| Kill | remediation/kill.rs | Terminates the target process (and optionally its tree). |
| Quarantine | remediation/quarantine.rs | Moves the file into a protected QuarantineStore and neutralizes it. |
| Isolate / unisolate | remediation/isolation.rs | Drives the driver’s WFP-based host network isolation. |
Isolation is enforced in the kernel: the executor issues NETWORK_ISOLATE / NETWORK_UNISOLATE
IOCTLs to AnyOneKcallback, with SET_LIFELINE allow-listing the addresses the agent needs to keep talking
to the gateway (so an isolated host can still receive the un-isolate command). See
Kernel Drivers.
Gating & audit
remediation/verdict.rs decides whether an action is warranted; remediation/executor.rs performs
it; remediation/audit.rs records the outcome. Server-dispatched actions arrive verified via
Command Trust and report back a CommandResult up the
Control Channel; autonomous actions (e.g. a local Malicious verdict from
Static Analysis) run under policy without a round trip.