gensecaihq/wazuh-autopilot/containment-playbooks

Containment Playbooks

The response-planner proposes these actions with propose_action. Any other agent holding this skill (e.g. responder) hands off to response-planner instead. The platform executor runs the Wazuh MCP tool only after policy and approval. No agent can call the executor tools listed below. Parameters must match what the executor expects or execution fails. Load wazuh-active-response for how Wazuh AR scripts, timeouts and agent-side requirements work.

Action reference

Before proposing, check the current state with the read-only tools: is the IP already blocked (wazuh_check_blocked_ip)? Is the agent connected (check_agent_health)? A disconnected agent can't run AR, so propose nothing it can't execute. Say so and escalate.

Outbound C2 blocking maps to D3-OTF Outbound Traffic Filtering; say so in the rationale when the blocked IP is a C2 destination rather than an inbound attacker.

When to use

block_ip — external attacker IP (brute force, exploitation, scanning with success risk). Through the Wazuh MCP Server the block is permanent until removed: there is no timeout. Undoing it needs wazuh_firewall_allow per agent plus an undo script the operator has deployed. Put the intended review time in the rationale. Omitting agent_id blocks fleet-wide, which can't be rolled back automatically, so prefer the affected agent unless the whole internet-facing fleet is under attack. Never block internal infrastructure IPs (DNS, proxies, NAT gateways): it blocks everyone behind them. Beware shared cloud/CDN IPs.

firewall_drop / host_deny — same intent as block_ip on a specific agent; host_deny uses TCP wrappers (/etc/hosts.deny) and affects only wrapper-aware services (e.g. sshd builds with libwrap). Prefer block_ip unless policy requires these.

isolate_host — confirmed compromise with active attacker, lateral movement or C2. Cuts the host off except for the Wazuh manager. High business impact on servers — state the service impact. Capture evidence first (host-forensics finding).

kill_process — single malicious process (miner, reverse shell) on an otherwise healthy host. Evidence first: record PID, path, command line, parent, hash from get_agent_processes (syscollector inventory, so confirm the PID is current). Malware may respawn: pair with persistence removal (human step) or isolation.

disable_user — account confirmed used maliciously. Note whether it's a service / break-glass account and the impact. Credential reset and session revocation are human recovery steps.

quarantine_file — malicious file on disk (web shell, dropped binary). Include the hash in the rationale. Quarantine, never delete.

active_response — custom AR scripts deployed by the operator. Use only when the command name is known to exist in the environment; otherwise don't propose. The default autonomy policy disables this type, so expect a refusal unless an admin enabled it.

restart_wazuh — agent misbehaving (not collecting, stuck), never as a security containment step. Low security value, may lose volatile context.

Rationale checklist

1. Evidence (alert ids, finding titles).
2. Why this action and not a less disruptive one.
3. Business impact and blast radius.
4. Dependencies / ordering.
5. Rollback path and verification tool.

Output

• response-planner: propose_action with exact params above. Others: hand off to

response-planner with the proposed action spelled out.

• For reviews, add_finding titled Containment review noting parameter problems,

protected-target conflicts, or missing rollback paths. standard_refs: MITRE-D3FEND:<id>, NIST-CSF-2:RS.MI.