<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-automated-containment
description: >-
  Implements automated incident containment using SOAR playbooks, EDR APIs,
  firewall automation, and identity provider integrations to reduce mean time
  to contain (MTTC) from hours to minutes.
domain: cybersecurity
subdomain: incident-response
tags:
  - automated-containment
  - SOAR
  - EDR-api
  - firewall-automation
  - network-isolation
  - account-lockout
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021"]
---

# Implementing Automated Containment

## Overview

Automated containment reduces mean time to contain (MTTC) from hours to seconds
by executing predefined response actions when specific threat conditions are met.
This skill covers SOAR playbook design, EDR API-driven host isolation, firewall
rule automation, identity provider account suspension, and DNS sinkholing — with
appropriate guardrails to prevent automated actions from causing more damage than
the incident.

**Critical principle**: automated containment requires a confidence threshold.
High-confidence detections (known malware hash, confirmed C2 beacon) auto-contain.
Medium-confidence detections require human approval. Never auto-contain on
low-confidence signals.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| SOAR platform | Playbook orchestration | XSOAR / Tines / Shuffle |
| CrowdStrike API | Endpoint isolation | API key configured |
| Palo Alto API | Firewall rule management | API key configured |
| Azure AD / Okta API | Account suspension | API tokens |
| DNS RPZ | DNS sinkholing | BIND or Infoblox |

## Key Concepts

### Containment Actions by Type

| Action | Target | API | Reversible? |
|--------|--------|-----|-------------|
| Host isolation | Endpoint | CrowdStrike/Defender | Yes |
| Firewall block | Network perimeter | PAN-OS/Fortinet | Yes |
| Account disable | Identity | Azure AD/Okta | Yes |
| DNS sinkhole | Domain resolution | DNS RPZ | Yes |
| Session revocation | Active sessions | IdP API | Yes |
| VLAN quarantine | Network segment | Switch API | Yes |

### Confidence-Based Automation Tiers

```
Tier 1 — Full Auto (no human approval):
  - Known malware hash match (multiple AV engines)
  - Confirmed C2 beacon to known-bad infrastructure
  - Active ransomware encryption detected
  - Credential dumping tool execution (Mimikatz, etc.)

Tier 2 — Human-in-the-Loop (approval required):
  - Suspicious but unconfirmed lateral movement
  - Anomalous authentication pattern
  - New/unknown binary with suspicious behavior
  - Outbound traffic to recently registered domain

Tier 3 — Alert Only (no containment):
  - Low-confidence behavioral detection
  - Reconnaissance activity
  - Policy violation without security impact
```

## Workflow

### Step 1 — Automated Host Isolation

```bash
# CrowdStrike — isolate endpoint
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
  -H "Authorization: Bearer $CS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ids":["'"$DEVICE_ID"'"]}'

# Microsoft Defender — isolate machine
curl -X POST "https://api.securitycenter.microsoft.com/api/machines/$MACHINE_ID/isolate" \
  -H "Authorization: Bearer $DEFENDER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"Comment":"Auto-containment - INC-2026-0342","IsolationType":"Full"}'

# SentinelOne — disconnect from network
curl -X POST "https://console.sentinelone.net/web/api/v2.1/agents/actions/disconnect" \
  -H "Authorization: ApiToken $S1_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"filter":{"ids":["'"$AGENT_ID"'"]}}'
```

### Step 2 — Automated Firewall Blocking

```bash
# Palo Alto PAN-OS — add IP to block list
curl -X POST "https://firewall.company.com/api/" \
  -d "type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address/entry[@name='block-$MALICIOUS_IP']&element=<ip-netmask>$MALICIOUS_IP/32</ip-netmask>&key=$PANOS_KEY"

# Palo Alto — add to dynamic block list (EDL update)
echo "$MALICIOUS_IP" >> /var/www/html/edl/incident-blocks.txt

# iptables — emergency network block
iptables -I INPUT -s "$MALICIOUS_IP" -j DROP
iptables -I OUTPUT -d "$MALICIOUS_IP" -j DROP
```

### Step 3 — Automated Account Containment

```bash
# Azure AD — disable account via Graph API
curl -X PATCH "https://graph.microsoft.com/v1.0/users/$USER_ID" \
  -H "Authorization: Bearer $GRAPH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"accountEnabled":false}'

# Azure AD — revoke all sessions
curl -X POST "https://graph.microsoft.com/v1.0/users/$USER_ID/revokeSignInSessions" \
  -H "Authorization: Bearer $GRAPH_TOKEN"

# Okta — suspend user
curl -X POST "https://company.okta.com/api/v1/users/$USER_ID/lifecycle/suspend" \
  -H "Authorization: SSWS $OKTA_TOKEN"

# AD — disable account via PowerShell
powershell -Command "Disable-ADAccount -Identity $USERNAME; Set-ADUser -Identity $USERNAME -Description 'Disabled by IR automation - INC-2026-0342'"
```

### Step 4 — DNS Sinkholing

```bash
# Add C2 domain to DNS RPZ zone
cat >> /etc/bind/rpz.db <<EOF
$C2_DOMAIN CNAME .
*.$C2_DOMAIN CNAME .
EOF

# Reload DNS
rndc reload rpz

# Verify sinkhole is active
dig @localhost $C2_DOMAIN
```

### Step 5 — Containment Verification

```bash
# Verify host isolation (CrowdStrike)
curl -s "https://api.crowdstrike.com/devices/entities/devices/v2?ids=$DEVICE_ID" \
  -H "Authorization: Bearer $CS_TOKEN" | jq '.resources[0].status'

# Verify firewall block
curl -s "https://firewall.company.com/api/?type=config&action=get&xpath=/config/devices/entry/vsys/entry/address/entry[@name='block-$MALICIOUS_IP']&key=$PANOS_KEY"

# Verify account disabled
curl -s "https://graph.microsoft.com/v1.0/users/$USER_ID?$select=accountEnabled" \
  -H "Authorization: Bearer $GRAPH_TOKEN" | jq '.accountEnabled'
```

## Detection

```yaml
title: Automated Containment Detection
id: 0db14035-eb4f-45fc-9932-70333d09af6c
status: experimental
description: Detects suspicious activity related to implementing automated containment techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*automated*"
  condition: selection
level: high
tags:
  - attack.t1021
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] Automated containment playbooks tested in staging environment
- [ ] Confidence tier thresholds defined and documented
- [ ] EDR isolation confirmed via API status check
- [ ] Firewall blocks verified with traffic test
- [ ] Account disablement confirmed via directory query
- [ ] DNS sinkhole active and resolving to null
- [ ] All containment actions logged with incident ticket reference
- [ ] Rollback procedures documented and tested for each action type

## References

- NIST SP 800-61r3: Section 3.3 — Containment
- SANS Automated Incident Response Whitepaper
- CrowdStrike Falcon API: https://falcon.crowdstrike.com/documentation
- Microsoft Graph API: https://learn.microsoft.com/en-us/graph/
- Palo Alto PAN-OS API: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-panorama-api
- MITRE ATT&CK Mitigation M1030 (Network Segmentation)
