Platform // WARDOG Response
Minimum sufficient action, fully accounted for.
Response is deliberately narrow. A small catalogue of well-understood actions, each with a fixed contract, is more defensible than a general-purpose automation engine.
action contract
Illustrative- 01PreconditionA stated, checkable condition that must be true before the action is even proposed.
- 02AuthorisationA signed, scoped, expiring token from the Gate. Without it, the executor refuses.
- 03ExecutionA narrow, typed operation against one target — no free-form command surface.
- 04VerificationThe environment is re-read to confirm the intended state actually holds.
- 05Rollback & auditA defined undo path where reversible, and a complete record either way.
Action catalogue
Endpoint and identity containment.
Each action states what must be true first. If the precondition cannot be evidenced, the action is not requested.
Endpoint isolation
Cuts host communication except the control channel, preserving forensic access.
precondition · verified malicious execution on host
Process termination
Stops a specific process lineage rather than a name match, avoiding collateral impact.
precondition · process identity confirmed in graph
File quarantine
Removes the artefact from reach while retaining a recoverable copy.
precondition · hash observed and classified
IOC blocking
Denies resolution or egress to confirmed infrastructure at the enforcement point.
precondition · indicator corroborated, not inferred
Token & session revocation
Invalidates active sessions and refresh material for the affected identity.
precondition · identity compromise verified
Malicious OAuth removal
Removes the consent grant that provides persistence independent of the password.
precondition · grant linked to attack chain
Forwarding-rule removal
Removes exfiltration rules and records the prior configuration.
precondition · rule created within incident window
Restraint
Doing less, provably.
Over-response is a failure mode with real business cost. WARDOG prefers the narrowest action that removes attacker capability, and escalates instead of widening scope on its own.
Escalation, not expansion
When an action would exceed configured blast radius, is irreversible, or rests on evidence below threshold, WARDOG stops and presents the case to an analyst — with the reasoning, the evidence, and the proposed action already assembled.
Request early access
WARDOG is in early access with a small number of design partners. Tell us about your estate and we will get back to you.