Response Verbs

The portal contains an endpoint with a fixed set of verbs. Each one records a D3FEND technique and an OCSF disposition on the case that dispatched it, so an action leaves the portal in the vocabulary a customer's own tooling already reads.

Where a verb acts

Two layers.

Network-layer verbs act on Whisper infrastructure, off the host. They hold on a machine that is already fully owned, because nothing on the machine has to cooperate for them to take effect.

Host-layer verbs are dispatched to the on-host sensor. They need the sensor present and armed for response, and the held key has to carry the dns:respond:write scope. The outcome shown is the one the sensor reported, not the one the dispatch asked for.

block-name

Stops a name resolving for that customer, as a rule in their resolver policy. Network layer, and reversible by removing the rule.

Example: block the destination a case found for the customer it affected, then take the same verdict across the book from shared infrastructure.

isolate

Cuts the endpoint's egress in the routing rather than on the machine, so the hold survives a compromised host. Network layer.

Example: isolate the endpoint a detection landed on while the case is still open, before deciding whether anything on disk needs touching.

release

Lifts a hold and returns the endpoint to normal egress. Network layer.

revoke

Cuts the identity itself. The address stops resolving, the per-address firewall drops, and the forward-confirmed reverse DNS chain is withdrawn. Network layer, and permanent.

The held key must carry admin:dns. Use it when the identity should end, not when an endpoint needs holding while you look at it: for that, isolate and allowlist-mode are the reversible options.

Example: an endpoint that has been decommissioned, or one whose credential you must assume is in someone else's hands.

quarantine-file

Moves a file into quarantine on the endpoint, verified by hash. Host layer: it is queued for that endpoint's sensor, and the outcome comes back from the sensor.

The file is named by its absolute path and its SHA-256, so the sensor acts on the object you meant rather than on a path that has since been rewritten.

push-firewall-policy

Replaces the endpoint's egress rule-set. Network layer.

It is a replacement, not a merge: what you send becomes the whole set, so every rule that should survive has to be in the call. Read the current set before pushing a new one.

allowlist-mode

Flips the endpoint's egress default from allow to deny, so every flow that is not explicitly allowed stops at the edge. Network layer, and reversible.

Example: an endpoint that should keep talking to two known destinations and nothing else, for as long as a case is open.

Blast radius

An identity can have others nested behind it. Blast radius shows which identities a containment takes down alongside the one you named, so the list is read before the verb is dispatched. Nested identities describes how that nesting arises.

What lands on the record

Every dispatch is audited: the verb, the endpoint, the operator who ran it, and the outcome the layer reported. The entry is written into the customer's own estate record, which is why the customer can read the same line you can. Audit and compliance covers reading it back, and playbooks covers running these verbs in an order without a person at each step.