<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Incident Response Actions — API Reference

## Evidence Collection Commands

```bash
# Volatile evidence (order matters — most volatile first)
# 1. Memory
date -u > /tmp/evidence/collection_time.txt
cat /proc/meminfo > /tmp/evidence/meminfo.txt

# 2. Running processes
ps auxf > /tmp/evidence/processes_tree.txt
ps -eo pid,ppid,user,args --sort=-pcpu > /tmp/evidence/processes_cpu.txt
ls -la /proc/*/exe 2>/dev/null > /tmp/evidence/proc_exe_links.txt

# 3. Network state
ss -tulnp > /tmp/evidence/listening_sockets.txt
ss -anp > /tmp/evidence/all_connections.txt
ip addr show > /tmp/evidence/network_interfaces.txt
ip route show > /tmp/evidence/routing_table.txt
arp -a > /tmp/evidence/arp_cache.txt
cat /etc/resolv.conf > /tmp/evidence/dns_config.txt

# 4. User activity
who > /tmp/evidence/logged_in_users.txt
last -a > /tmp/evidence/login_history.txt
lastlog > /tmp/evidence/last_login.txt
cat /etc/passwd > /tmp/evidence/passwd.txt
cat /etc/shadow > /tmp/evidence/shadow.txt  # requires root

# 5. Persistence mechanisms
crontab -l > /tmp/evidence/crontab_root.txt 2>&1
ls -la /etc/cron.* > /tmp/evidence/cron_dirs.txt
systemctl list-unit-files --type=service > /tmp/evidence/services.txt
cat /etc/rc.local > /tmp/evidence/rc_local.txt 2>/dev/null

# 6. File system
find / -mtime -1 -type f 2>/dev/null > /tmp/evidence/recently_modified.txt
find /tmp /var/tmp /dev/shm -type f > /tmp/evidence/temp_files.txt
lsof +L1 > /tmp/evidence/deleted_but_open.txt 2>/dev/null
```

## psutil Python API

```python
import psutil

# Process listing
for proc in psutil.process_iter(['pid', 'name', 'username', 'cmdline']):
    print(proc.info)

# Network connections
for conn in psutil.net_connections(kind='inet'):
    print(conn.laddr, conn.raddr, conn.status, conn.pid)

# Disk usage
psutil.disk_usage('/')

# System info
psutil.boot_time()
psutil.users()
psutil.cpu_count()
```

## Containment Actions

```bash
# Network isolation (iptables)
iptables -I INPUT -s <attacker_ip> -j DROP
iptables -I OUTPUT -d <attacker_ip> -j DROP

# Kill malicious process
kill -9 <pid>

# Disable user account
usermod -L <username>
passwd -l <username>

# Disable SSH key
mv /home/<user>/.ssh/authorized_keys /home/<user>/.ssh/authorized_keys.disabled
```

## Forensic Disk Imaging

```bash
# Create forensic image with dd
dd if=/dev/sda of=/mnt/evidence/disk.img bs=4M status=progress

# Create with hash verification
dd if=/dev/sda bs=4M | tee /mnt/evidence/disk.img | sha256sum > /mnt/evidence/disk.sha256

# Mount image read-only
mount -o ro,loop,noexec /mnt/evidence/disk.img /mnt/analysis/
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Action completed successfully |
| 1 | Suspicious findings detected |
| 2 | Action failed or insufficient permissions |
