Contain an Endpoint
Put a reversible hold on a machine at the network layer, lift it again, or cut the address for good.
On this page (6)
Contain an Endpoint Documentation
Start with the hold you can lift. Reach for the permanent cut only when you mean it.
| Layer | Action | What it does | What it needs |
|---|---|---|---|
| Network, off the host | firewall default-deny | flips the address's default from allow to deny, so every flow not explicitly allowed stops at the edge | nothing on the machine |
| Network, off the host | revoke | cuts the identity itself: DNS stops resolving, the per-address firewall drops, and the forward-confirmed reverse DNS chain is withdrawn | nothing on the machine |
| Host | kill | the sensor ends a running process, pinned so it cannot be swapped underneath | the sensor armed for response |
| Host | quarantine | the sensor moves a file aside, hash-verified | the sensor armed for response |
The two network actions act on Whisper infrastructure, not on the endpoint, which is why they hold even when the machine is entirely in someone else's hands. The response ladder is why they are separated this way.
1. Get the address
whisper list
Or take it from the host's row in the console's fleet view. Everything below is keyed on that address.
2. Place the hold
Set the default to deny, and allow only what the machine needs while you work on it. The first matching rule wins, and anything that matches nothing falls to the default.
curl -s -X POST https://graph.whisper.online/api/query \
-H 'content-type: application/json' \
-H 'X-API-Key: <your key>' \
--data-binary @- <<'JSON'
{"query": "CALL whisper.agents({op: 'firewall', address: '2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478', default: 'deny', rules: [{action: 'allow', match: 'host', value: 'updates.example.com'}]})"}
JSON
A rule matches on ip, cidr, host or port. A host value covers that name and everything under it.
3. Read it back
Omit rules and the same call answers with what is in force:
curl -s -X POST https://graph.whisper.online/api/query \
-H 'content-type: application/json' \
-H 'X-API-Key: <your key>' \
--data-binary @- <<'JSON'
{"query": "CALL whisper.agents({op: 'firewall', address: '2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478'})"}
JSON
Do this before you tell anyone the machine is held. The read-back is the evidence; the write only says the request was accepted.
4. Lift it
The same call with default: 'allow' returns the address to normal. Nothing else needs undoing, and the host does not need to be reachable for the hold to lift.
Cutting the address for good
whisper kill --revoke 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
whisper: 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 - released
This withdraws the address, its reverse DNS and its egress credentials, and refuses the identity's access to the control plane. It is permanent. The machine can be brought back later, but under a new address, with a new record and none of the old one's history attached to it. The command confirms before it acts, and in a non-interactive run --yes is required, because nothing should be able to destroy an identity without somebody saying so.
Your key needs the authority to revoke, which is not the same grant as the one that writes a firewall rule: see Keys and scopes. The wire contract for both is Firewall and response, and Revoke covers the identity side on its own.
Proving it held
Every containment is committed to a tamper-evident, signed transparency log, so what was cut and when can be shown to somebody who does not have your key and does not take your word for it. The transparency log is how to read it, and once an address is revoked the keyless checks in verifying an identity answer that it is gone.