Response Actions

Tamandua EDR provides comprehensive response capabilities to contain, remediate, and recover from security incidents. Response actions can be triggered automatically based on detection rules or executed manually by security analysts.

Response Capabilities Overview

+------------------+     +------------------+     +------------------+
|   Detection      | --> |  Response Policy | --> |  Action Executor |
|   Engine         |     |  Engine          |     |                  |
+------------------+     +------------------+     +--------+---------+
                                                          |
                    +-------------------------------------+
                    |                                     |
          +---------v---------+                 +---------v---------+
          |  Agent Actions    |                 |  Server Actions   |
          |  - Kill Process   |                 |  - Block Hash     |
          |  - Quarantine     |                 |  - Update Rules   |
          |  - Isolate        |                 |  - Alert          |
          |  - Collect        |                 |  - Notify         |
          +-------------------+                 +-------------------+

Available Actions

Process Actions

File Actions

Network Actions

System Actions

AI/Model Actions

Kill Process

Immediately terminate a malicious or suspicious process.

Usage

# Via CLI
tamanduactl response kill-process --pid 1234

# Via API
curl -X POST "https://api.tamandua.io/v1/agents/{agent_id}/commands" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "command_type": "KillProcess",
    "payload": {
      "pid": 1234,
      "reason": "Ransomware detected",
      "force": true
    }
  }'

Options

Response

{
  "success": true,
  "result_data": {
    "pid": 1234,
    "process_name": "malware.exe",
    "terminated": true,
    "children_terminated": 2
  }
}

Quarantine File

Move a malicious file to an encrypted quarantine vault.

How It Works

1. File is copied to quarantine directory
2. Original file is securely deleted
3. File is encrypted with AES-256
4. Metadata is recorded for restoration
5. File can be analyzed or restored later

Usage

# Via CLI
tamanduactl response quarantine --path "C:\malware\evil.exe"

# Via API
curl -X POST "https://api.tamandua.io/v1/agents/{agent_id}/commands" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "command_type": "QuarantineFile",
    "payload": {
      "path": "C:\\malware\\evil.exe",
      "reason": "YARA match: Ransomware_LockBit"
    }
  }'

Options

Quarantine Management

# List quarantined files
tamanduactl quarantine list

# Get quarantine details
tamanduactl quarantine info --id quarantine_123

# Restore file
tamanduactl quarantine restore --id quarantine_123 --path "C:\restored\"

# Delete from quarantine
tamanduactl quarantine delete --id quarantine_123

# Export report
tamanduactl quarantine export --format json

Network Isolation

Completely isolate an endpoint from the network while maintaining management connectivity.

How It Works

Windows (WFP - Windows Filtering Platform):

1. Creates WFP filters blocking all traffic
2. Allows only Tamandua management traffic
3. Blocks both inbound and outbound
4. Survives process restart

Linux (iptables/nftables):

1. Creates Tamandua-owned nftables tables or iptables chains
2. Avoids flushing system-owned firewall rules
3. Allows Tamandua management IPs
4. Persists only when the validated platform profile enables persistence

macOS (pf):

1. Configures packet filter rules
2. Blocks all except management
3. Enables anchor for Tamandua rules

Usage

# Isolate endpoint
tamanduactl response isolate --reason "Active ransomware"

# Unisolate endpoint
tamanduactl response unisolate

# Check isolation status
tamanduactl response isolation-status

API

# Isolate
curl -X POST "https://api.tamandua.io/v1/agents/{agent_id}/commands" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "command_type": "IsolateNetwork",
    "payload": {
      "reason": "Ransomware containment",
      "notify_user": true,
      "duration_hours": 24
    }
  }'

# Unisolate
curl -X POST "https://api.tamandua.io/v1/agents/{agent_id}/commands" \
  -d '{"command_type": "UnisolateNetwork", "payload": {}}'

Isolation Options

Block Hash

Block execution of files with specific hash globally across all endpoints.

Usage

# Block a hash
tamanduactl response block-hash \
  --sha256 abc123... \
  --reason "Known ransomware"

# Via API
curl -X POST "https://api.tamandua.io/v1/blocklist/hash" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "sha256": "abc123...",
    "reason": "Known ransomware",
    "severity": "critical",
    "action": "block_and_quarantine"
  }'

Block Actions

Managing Blocklist

# List blocked hashes
tamanduactl blocklist hash list

# Remove from blocklist
tamanduactl blocklist hash remove --sha256 abc123...

# Import blocklist
tamanduactl blocklist hash import --file hashes.txt

# Export blocklist
tamanduactl blocklist hash export --format json

Remediation Policies

Configure automated responses based on detection severity and type.

Policy Configuration

# remediation_policy.yaml
policies:
  - name: "Critical Threat Response"
    conditions:
      severity: critical
      detection_type:
        - ransomware
        - credential_theft
    actions:
      - type: kill_process
        options:
          force: true
          kill_children: true
      - type: quarantine_file
        options:
          submit_sample: true
      - type: isolate_network
        options:
          duration_hours: 4
          notify_user: true
      - type: create_snapshot
      - type: notify
        options:
          channels: [email, slack, pagerduty]

  - name: "High Threat Response"
    conditions:
      severity: high
      confidence: ">= 85"
    actions:
      - type: kill_process
      - type: quarantine_file
      - type: notify
        options:
          channels: [email, slack]

  - name: "Medium Threat Response"
    conditions:
      severity: medium
    actions:
      - type: notify
        options:
          channels: [slack]
      - type: collect_artifact

Applying Policies

# Apply policy
tamanduactl policies apply remediation_policy.yaml

# List active policies
tamanduactl policies list

# Disable policy
tamanduactl policies disable "Critical Threat Response"

# Test policy against detection
tamanduactl policies test --detection-id det_123

Operator-Approved Response

Tamandua supports operator-approved response workflows. Autonomous response is experimental and should be enabled only after deployment-specific validation, containment scoping, and rollback testing.

Configuration

# autonomous_response.yaml
autonomous:
  enabled: true

  # Only auto-respond above this confidence
  min_confidence: 90

  # Detection types that allow autonomous response
  allowed_types:
    - ransomware
    - credential_theft
    - c2_beacon
    - cryptominer

  # Actions that can be taken autonomously
  allowed_actions:
    - kill_process
    - quarantine_file
    - block_hash
    # - isolate_network  # Requires approval

  # Rate limiting
  max_actions_per_hour: 100
  max_isolations_per_hour: 5

  # Notification on autonomous action
  notify:
    channels: [email, slack]
    include_evidence: true

Safeguards

1. Confidence Threshold: Only high-confidence detections trigger autonomous response
2. Type Restrictions: Limited to specific threat types
3. Action Limits: Rate limiting prevents mass actions
4. Human Oversight: Critical actions require approval
5. Audit Trail: All actions are logged

Monitoring Autonomous Actions

# List recent autonomous actions
tamanduactl autonomous list --last 24h

# Get action details
tamanduactl autonomous details --id action_123

# Override/rollback action
tamanduactl autonomous rollback --id action_123

VSS Rollback (Ransomware Recovery)

Automatically recover encrypted files using Volume Shadow Copies.

How It Works

1. Detect ransomware encryption activity
2. Identify encrypted files by extension changes
3. Find pre-encryption snapshots
4. Restore files from snapshots
5. Quarantine ransomware executable

Usage

# Find encrypted files
tamanduactl vss find-encrypted --path "C:\Users"

# Preview rollback
tamanduactl vss preview-rollback --path "C:\Users\Documents"

# Execute rollback
tamanduactl vss rollback --path "C:\Users\Documents" --snapshot snap_123

# Auto-remediate ransomware
tamanduactl vss ransomware-remediate --agent agent_123

API

curl -X POST "https://api.tamandua.io/v1/agents/{agent_id}/commands" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "command_type": "VssRansomwareRollback",
    "payload": {
      "path": "C:\\Users",
      "extensions": [".encrypted", ".locked"],
      "dry_run": false
    }
  }'

Live Response Shell

Execute commands directly on endpoints for investigation and remediation.

Starting a Session

# Start interactive shell
tamanduactl shell --agent agent_123

# Execute single command
tamanduactl shell --agent agent_123 --command "dir C:\Users"

Shell Capabilities

Security Controls

• Requires elevated permissions
• All commands logged to audit trail
• Session timeout after inactivity
• IP-based session restrictions
• MFA required for shell access

Response API Reference

Execute Command

POST /api/v1/agents/{agent_id}/commands

{
  "command_type": "KillProcess|QuarantineFile|IsolateNetwork|...",
  "payload": { ... },
  "async": false,
  "timeout": 30000
}

Get Command Status

GET /api/v1/commands/{command_id}

{
  "id": "cmd_123",
  "status": "completed",
  "result": { ... },
  "duration_ms": 150,
  "executed_at": "2025-01-15T10:00:00Z"
}

List Agent Commands

GET /api/v1/agents/{agent_id}/commands?status=completed&limit=50

{
  "commands": [...],
  "total": 150
}

Audit and Compliance

All response actions are logged for audit and compliance:

Audit Log Entry

{
  "timestamp": "2025-01-15T10:30:00Z",
  "action": "QuarantineFile",
  "agent_id": "agent_123",
  "user": "analyst@company.com",
  "target": "C:\\malware\\evil.exe",
  "reason": "YARA match: Ransomware_LockBit",
  "result": "success",
  "trigger": "autonomous",
  "detection_id": "det_456"
}

Accessing Audit Logs

# Query audit logs
tamanduactl audit query \
  --action QuarantineFile \
  --start 2025-01-01 \
  --end 2025-01-15

# Export for compliance
tamanduactl audit export \
  --format csv \
  --output audit_report.csv

Related Documentation

• Detection Overview - Detection capabilities
• MITRE Coverage - ATT&CK technique mapping
• Threat Intelligence - IOC feeds and blocking