<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Containing Active Breach — API Reference

## EDR Containment APIs

### CrowdStrike Falcon — Host Containment

```bash
# Contain (network isolate) a host
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ids":["DEVICE_ID_1","DEVICE_ID_2"]}'

# Lift containment
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=lift_containment" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"ids":["DEVICE_ID"]}'

# Check containment status
curl -s "https://api.crowdstrike.com/devices/entities/devices/v2?ids=DEVICE_ID" \
  -H "Authorization: Bearer $TOKEN" | jq '.resources[0].status'
```

### Microsoft Defender for Endpoint

```bash
# Isolate machine
curl -X POST "https://api.securitycenter.microsoft.com/api/machines/$ID/isolate" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"Comment":"IR containment","IsolationType":"Full"}'

# Release from isolation
curl -X POST "https://api.securitycenter.microsoft.com/api/machines/$ID/unisolate" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"Comment":"Containment lifted post-investigation"}'
```

### SentinelOne — Network Quarantine

```bash
curl -X POST "https://usea1.sentinelone.net/web/api/v2.1/agents/actions/disconnect" \
  -H "Authorization: ApiToken $S1_TOKEN" \
  -d '{"filter":{"ids":["AGENT_ID"]}}'
```

## Firewall Commands

### iptables (Linux)

```bash
# Block outbound to C2
iptables -I OUTPUT -d $C2_IP -j DROP
iptables -I FORWARD -d $C2_IP -j DROP

# Allow only IR jump box
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -A INPUT -s $JUMPBOX -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -d $JUMPBOX -p tcp --sport 22 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Save rules
iptables-save > /etc/iptables/rules.v4
```

### Windows Firewall

```powershell
# Block outbound to C2
New-NetFirewallRule -DisplayName "Block C2" -Direction Outbound -RemoteAddress $C2_IP -Action Block

# Block all except IR
New-NetFirewallRule -DisplayName "Allow IR" -Direction Inbound -RemoteAddress $IR_IP -Action Allow
Set-NetFirewallProfile -Profile Domain,Public,Private -DefaultInboundAction Block
```

## Active Directory Containment

```powershell
# Disable account
Disable-ADAccount -Identity "username"

# Force password change
Set-ADUser -Identity "username" -ChangePasswordAtLogon $true

# Revoke Azure AD sessions
Revoke-AzureADUserAllRefreshToken -ObjectId $OBJECT_ID

# Reset krbtgt (Golden Ticket remediation — do twice, 12h apart)
Reset-KrbtgtPassword -Domain "corp.example.com"
```

## DNS Sinkhole

```bash
# dnsmasq sinkhole
echo "address=/$MALICIOUS_DOMAIN/127.0.0.1" >> /etc/dnsmasq.d/sinkhole.conf
systemctl restart dnsmasq

# BIND RPZ
echo "$MALICIOUS_DOMAIN CNAME ." >> /etc/bind/rpz.db
rndc reload
```

## Common Patterns

### Containment Priority Order

1. Block active C2 channels (network)
2. Isolate compromised endpoints (EDR)
3. Disable compromised accounts (identity)
4. Segment affected network zones (infrastructure)
5. Revoke sessions and tokens (identity)
6. Monitor for containment bypass (detection)

### Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `device_id` | EDR device identifier | `abc123def456` |
| `isolation_type` | Full or selective isolation | `Full` |
| `c2_indicator` | C2 IP or domain | `45.33.32.156` |
| `containment_scope` | Host, network, or identity | `all` |
