RespondAgent executes defensive actions based on the ThreatVerdict produced by the AnalyzeAgent. It implements strict safety rules, a graduated escalation ladder, and full rollback support.
Response Modules
Guard includes 3 active response modules plus notification and logging:1. IP Blocker
Blocks malicious source IPs at the firewall level.2. Process Killer
Terminates malicious processes.3. File Quarantine
Isolates suspicious files by moving them to a quarantine directory.Confidence Thresholds
The RespondAgent uses confidence-based decision making:
In Learning Mode, all events are logged without active response regardless of confidence.
Safety Rules
The RespondAgent enforces hard safety limits that cannot be overridden:Whitelisted IPs
These IPs are never blocked, even if they trigger detections:Protected Processes
These processes are never killed:Protected Accounts
These accounts are never disabled:Network Isolation Threshold
Network isolation (blocking all traffic from an IP) requires confidence >= 95. This prevents accidental lockouts from aggressive but uncertain detections.Escalation Ladder
The RespondAgent implements progressive escalation:
This means a persistent attacker faces increasingly aggressive responses while first-time anomalies are treated conservatively.
Action Persistence and Rollback
All executed actions are persisted to a JSONL manifest file:Rollback Examples
Cross-Platform Command Execution
All OS commands are executed viaexecFile (never exec) to prevent shell injection:
The RespondAgent never uses
shell: true or string-based command construction. All parameters are
passed as array arguments to execFile to prevent command injection vulnerabilities.