Investigation & Remediation
Once a change crosses the incident threshold, Antemure investigates it from several angles with an AI fan-out and then — only when policy allows — remediates through a constrained, self-protecting tool layer that verifies the fix and rolls back on failure. Autonomy is off by default.
Investigation
Reasoning scores heuristically first (detection rules set risk floors; the hub knowledge graph can raise a known fleet threat to the investigation floor). If the score crosses reasoning.incident_risk_threshold (default 0.6) and the gateway is reachable, Antemure runs a fan-out investigation: five lenses — cause, network, blast-radius, attack-pattern and drift — each with three focused sub-agents (15 concurrent gateway calls). A synthesizer merges the findings into one verdict and can downgrade a heuristic false positive. Every step, the backend used (llm or heuristic), the ATT&CK techniques and the confidence factors are recorded in an investigation trail and persisted with a SHA-256 content hash for approver audit. Telemetry is redacted before anything leaves the box for the gateway.
The reasoning runs against an OpenAI-compatible gateway (default gateway.secureinsights.ai; the hosted gateway holds provider keys). BYOK lets you point llm.base_url at your own endpoint (vLLM/Ollama/LM Studio) for on-prem or air-gapped use. Four model slots are configurable: synthesis (model), fast investigators (investigator_model), the remediation agent (agent_model), and the provider.
Spend governor
A governor enforces a daily token budget (reasoning.daily_token_budget, default 10M), a per-minute call cap (gateway_max_calls_per_min, default 240) and a circuit breaker, pacing the investigator fan-out rather than collapsing it. Real token usage is charged from the gateway response. Over budget, reasoning degrades gracefully to deterministic heuristics — detection never stops.
Risk tiers
The node's risk_tier is the master gate on enforcement:
| Tier | Behavior |
|---|---|
watch (default) | Observe and reason only — no enforcement. Correct for early evaluation. |
low / medium / high | Auto-remediation permitted, subject to per-incident authorization and the action allowlist. |
critical | Requires human approval. |
Action catalog
Remediation runs either as the agentic loop (the LLM reasons → runs a guarded command → observes → verifies, up to 40 steps, every step streamed to the console) or via the constrained tool API (the fallback). Both draw from the same allowlisted catalog:
| Group | Actions |
|---|---|
| Endpoint | kill_process, quarantine_file, block_network, disable_service, remove_persistence, restore_file, rollback_change, revoke_token, isolate_host |
| Service (SRE, recoverable) | restart_service, start_service, reload_service, enable_service, create_service, remove_service, create_cronjob, remove_cronjob |
| Kubernetes | isolate_pod, kill_pod, cordon_node, scale_deployment_zero, rollback_deployment, revoke_sa_token |
| Cloud | cloud_isolate_instance, cloud_stop_instance, cloud_disable_key |
Only the purely-reverting actions (restore_file, rollback_change, revoke_token) auto-run; everything else is approval-gated by default via remediation.approval_actions. The four recoverable service actions (restart/start/reload/enable_service) always ship regardless of the allowlist — they drive SRE auto-recovery — but remain subject to the self-protection guard below.
Safety guards
These are enforced in code at three layers (hub refuses to draft/apply, node refuses to execute regardless of sender, and the dispatch path re-checks):
- Action allowlist — destructive actions must be in
remediation.allowed_actions; recoverable SRE service ops always ship. - Self-protection — a by-construction refusal before every action: never kill protected processes (sshd, systemd/PID 1, the Antemure agent, kernel threads), never stop a live managed service without approval, never block the node's own gateway/hub (self-DoS), never touch operator SSH keys or auth databases. Protected hosts/services/paths are derived per node plus operator-declared
protected_services/protected_paths. - Operator-lockout protection — mutating commands against
authorized_keys,.ssh,sshd_config,passwd/shadoware refused (reads allowed); so are host power-off/reboot, killing sshd or PID 1,rm -rf /and wholesale firewall flushes. - Forbidden-command guard — every command in the agentic loop passes the same check; anything that would sever the management/rollback path is blocked while recoverable equivalents (e.g.
restart, specific-IP blocks) are allowed.
Host isolation is a symmetric, atomic iptables transaction that preserves loopback, established connections, inbound SSH and outbound to the hub and gateway — and aborts if it cannot resolve a control path (fail-safe), so Antemure never locks you out of the box it is defending.
Verified rollback
Each action carries rollback data and a post-condition check (file absent after quarantine/remove, PID dead after kill, file present after restore). On a verified-false result with rollback_on_verify_fail (default on), the action is automatically reversed. Independently, the agentic loop re-checks on disk that the threat is actually gone before trusting the LLM's “done,” rejecting a false completion up to three times before escalating. Verification is automatic and never human-gated.
Parallel waves
A plan is grouped into ordered phases — contain (isolate/block) → neutralize (kill/disable) → cleanup — with distinct targets running concurrently within a wave (bounded by reasoning.max_fanout) and same-target actions serialized across waves.
Autonomy & approvals
Standing autonomy is driven solely by the hub-authoritative autonomous_remediation flag (set in Administration → Fleet config, admin-password-gated) — it is deliberately not inferred from an empty approval list. Otherwise each incident raises one deduplicated authorization request, and a human “Approve” (or “Approve ALL” for standing per-incident-type authority) grants it. The fleet-managed remediation_behavior maps manual→Watch, quarantine→Medium, auto→Low; approval_actions, max_actions_per_incident and allow_auto_kill are all fleet-configurable. A genuinely failed action (not a policy refusal) can hand off to a SOAR playbook.