Skip to content

Auto Containment

Jump to bottom
Mohhudib edited this page May 29, 2026 · 3 revisions

Auto-Containment

When a CRITICAL threat is detected (canary hit, ransomware extension rename, or combined score >= 70), Hybrid R-Sentry automatically executes a tree-aware multi-stage containment sequence across the entire malicious process tree without requiring any human intervention.

Containment Pipeline

CRITICAL event detected
         │
         ▼
Enumerate full process tree
  └── Two-sweep enumeration catches race conditions
  └── All children and grandchildren included
         │
         ▼
Stage 1: SIGSTOP (entire tree)
  └── Freeze root process + all child processes
  └── All processes suspended in memory — no cleanup code runs
         │
         ▼
Stage 2: Evidence Capture
  └── Read /proc/{pid}/ for each process in tree
  └── Capture open file descriptors
  └── Capture network connections
  └── Up to 48 files collected per process tree
         │
         ▼
Stage 3: iptables DROP
  └── Block all outbound traffic from the process owner UID
  └── Prevents data exfiltration or C2 communication
  └── Rule: -m owner --uid-owner {uid} -j DROP
         │
         ▼
Stage 4: SIGKILL (entire tree)
  └── Terminate all processes in tree permanently
  └── No cleanup code runs
         │
         ▼
Stage 5: Report
  └── Send CONTAINMENT_COMPLETE event to backend
  └── Auto-acknowledge all CRITICAL alerts for this host
  └── Update host risk score

Tree-Aware Containment

The containment pipeline targets the entire process tree, not just the root PID. This prevents the common attack technique where ransomware spawns child processes to continue encryption after the parent is killed.

Two-sweep enumeration: The process tree is enumerated twice before issuing any signals. The second sweep catches processes spawned between the first scan and the SIGSTOP. This closes the race condition window where a fast-spawning process could escape containment.

Scope: Up to 48 files of forensic evidence are collected across all processes in the tree.

Evidence Collection

During Stage 2, the following forensic data is captured for each process in the tree and stored in the database:

Data Source
Process name and PID /proc/{pid}/comm
Full command line /proc/{pid}/cmdline
Open file descriptors /proc/{pid}/fd/
Network connections psutil.net_connections()
Process start time psutil.Process.create_time()
Parent process chain psutil ancestry walk

Evidence can be exported from the Reports page as a PDF or from the Alerts page using the Forensic Export button.

Auto-Acknowledgment After Containment

Once CONTAINMENT_COMPLETE fires:

  1. All CRITICAL alerts for that host are automatically acknowledged
  2. Host risk score is recalculated (drops significantly)
  3. Dashboard updates in real time via WebSocket

Dry Run Mode

For safe testing, set DRY_RUN=true in .env. In dry run mode:

  • SIGSTOP and SIGKILL are not sent
  • iptables rules are not applied
  • Evidence is still captured and logged
  • All events and alerts are still created normally

Manual Containment

In addition to auto-containment, operators can manually mark a host as contained from the Hosts page. This:

  • Sets is_contained = true in the database
  • Displays a CONTAINED badge on the host card
  • Does not send any signals to processes (administrative flag only)
  • Can be released with the Release Host button once the host is confirmed clean

Clone this wiki locally