containment-advisor

Threat containment strategies prioritize minimal production impact and reversibility by analyzing threat type, blast radius, and active status. This approach recommends primary and secondary actions like isolating affected segments or disabling service accounts while stating potential critical service impacts.

To respond to spreading ransomware, containment actions include isolating affected network segments and disabling compromised service accounts. The system evaluates the blast radius and active threat status to recommend targeted isolation and credential management actions.

Human approval is required for all mutating containment intents, specifically requiring authorization from soc_lead and ciso roles. Mutating categories include credential_operation, network_change, and remediation_action, ensuring critical infrastructure changes have oversight.

Yes, managing credential exposure is handled through credential_operation containment actions. The system classifies and recommends specific credential management strategies as primary or secondary actions based on the assessed threat type and blast radius.

Yes, evaluating blast radius is required before recommending action to ensure minimal production impact. The impact assessment analyzes the blast radius, production impact, and reversibility of the threat to determine the appropriate containment strategy.