Quarantine Vault
IR-grade forensic containment built into your IDE. Chain-of-custody from detection to signed evidence bundle — one right-click.
IR-grade forensic containment built into your IDE. Chain-of-custody from detection to signed evidence bundle — one right-click.
This is not AV quarantine. When a suspicious file is detected — by the Cyber Agent, an analyst, or an automated rule — it goes through a full chain-of-custody pipeline designed to satisfy three audiences simultaneously: the analyst who needs to investigate the artifact safely, the auditor who needs to verify nothing was tampered with, and the court (theoretical, but the bar we built to) that requires cryptographically-backed evidence integrity. The same workflow a SOC analyst would run by hand with a dozen tools, automated into a single right-click.
SHA-256, SHA-1, MD5, and ssdeep (fuzzy hash for variant detection) are all captured at quarantine time. Multiple algorithms for interoperability with every forensic tool an investigator might already use.
The file is sealed inside an AES-256-GCM encrypted container with a .fc-quarantine extension. It cannot be double-clicked, cannot auto-execute, and will not detonate a payload if accidentally opened in a file browser. Losslessly recoverable with the vault key when an analyst is ready to work in a sandbox.
A JSON snapshot of everything that could change once the file leaves its original location: full original path, file size, all three timestamps (created / modified / accessed), Windows owner SID in raw S-1-5-21-... format for SIEM correlation, full SDDL access control list, NTFS attributes, MFT record number, alternate data streams, and PE header info for executables including Authenticode signature state (valid / invalid / unsigned).
Every quarantine action writes a log entry whose HMAC includes the previous entry's hash. Modify any entry — even a single byte — and the chain breaks at exactly that point. The Verify Log button (or cyber_verify_quarantine_log tool) walks the chain and reports the exact line number where tampering occurred.
The vault root is locked to the daemon user + SYSTEM + Administrators with proper inheritance. Non-elevated user processes — and any malware running as the current user — cannot read, modify, or delete vault contents.
Forensic artifacts are only useful if you can reconstruct what was happening at the time. Three snapshots are captured at quarantine time so an analyst has the full picture three days later.
Process context: Full process tree at quarantine time — what was running, what spawned what, command lines, parent-child relationships.
System baseline: OS build, hostname, current user, timezone, Defender status, network configuration at the moment of detection.
Persistence breadcrumbs: Automatic scan for registry Run keys, scheduled tasks, services, and startup folder entries that reference the quarantined file. If the file established persistence, the vault records exactly how and where.
An operator can decrypt and restore the original file with hash re-verification at restore time. Every release is logged with actor identity, timestamp, target path, and hash-match outcome.
After 15 minutes (configurable), if a file's stored hash still matches its sidecar, the entry is atomically moved to sealed/ and marked read-only. The vault becomes immutable over time — sealed entries cannot be modified, only released or exported.
Optional. When enabled, every quarantine action queues a pending request that a second operator must approve before the file is actually moved. Approval and denial are both logged with both operators' identities. The gate can be toggled on or off live — toggling it off auto-denies any queued requests with a logged reason so they can never silently execute later.
Produces a .fc-irbundle file (FCIB ZIP) containing the sidecar JSON, the defanged payload, the relevant log excerpt, a STIX 2.1 IOC document, and an ed25519 manifest signature with the embedded public key for verification. The bundle is the unit you hand off to external IR tooling, an insurance carrier, or law enforcement.
Partial-write recovery: If the daemon crashes mid-quarantine, the next boot finds the half-state in pending/ and either completes the operation or rolls back cleanly. No half-quarantined files, no orphaned metadata.
Vault rotation: Configurable size budget; oldest sealed entries spill to cold storage or are pruned per retention policy.
Network share and removable media: Quarantining from a UNC path or removable drive correctly captures the volume metadata and handles disconnection gracefully.
A dedicated Quarantine Vault tab on the Cyber panel. Everything visible in the screenshot above:
Each vault row has a VT button that calls cyber_vt_lookup_hash with the entry's SHA-256. The design choice here matters: hash lookup only, no file submission. The quarantined file never leaves the host. Uploading a quarantined sample to VirusTotal would expose it to every VT Enterprise subscriber — a serious operational security failure when you don't know whether the sample contains your organization's confidential data, a customer's data, or a piece of malware whose author is watching VT submissions for analyst telemetry.
The verdict renders as a color-coded banner (red = MALICIOUS, orange = SUSPICIOUS, green = CLEAN, grey = NOT_FOUND) with detection ratio, suggested threat label, a direct "Open in VT" link, and the full JSON response for the forensic record.
Everything in the UI is exposed to the Cyber Agent as tools. An analyst can drive the entire vault workflow conversationally if they prefer.
Plus the broader 79-tool Cyber Agent suite — YARA scan, PE info, hash, strings, IOC search, baseline diff, verdict recording — available in the same session.
The test suite lives at agent-daemon/test/quarantine-ir-grade.test.ts and is isolated from the production vault via the CYBER_QUARANTINE_ROOT environment variable pointing to a temp directory. Run it any time, before any release, after any change.
| Category | What is verified |
|---|---|
| Happy-path round-trip | Ingest → sidecar created → original file removed → forensic snapshot complete (timestamps, size, raw SID, full SDDL) → multi-hash captured → defang sealed → HMAC log entry written |
| Cryptographic round-trip | AES-256-GCM encrypt then decrypt produces a byte-identical original. Same operation the Defang Self-Test button runs. |
| Release and restore | Decrypt → write to target path → re-hash → assert byte-match with the original SHA-256 → cleanup of quarantine entry |
| Adversarial: log tamper | Manually mutate a log line → verify tool detects the break → returns the correct brokenAtLine value |
| Adversarial: sidecar tamper | Mutate the sidecar JSON → verify path detects mismatch |
| Adversarial: payload tamper | Mutate the defanged payload behind the daemon's back → integrity check surfaces it |
| Error paths | Unknown IDs, nonexistent source files, double-release, bogus operations — all return clean errors without corrupting vault state |
| Bundle export | FCIB magic header check + embedded ed25519 public key verified on the produced bundle |
| Approval workflow | Enable gate → quarantine queues → second-party approves → execution proceeds → both events logged with correct identities |
| List and stats | Coherent entry counts, vault size, and log integrity status across multiple interleaved operations |
The test suite earned its keep immediately. On the very first run it caught a silent forensic-data-loss bug that had been in production: every Windows sidecar had empty ownerSid, acl, and pe.authenticodeState fields. The root cause was a known TypeData double-registration bug in Microsoft.PowerShell.Security on machines with PowerShell 7 installed side-by-side — Get-Acl and Get-AuthenticodeSignature were throwing CommandNotFoundException, which -ErrorAction SilentlyContinue swallowed silently while reporting success.
The fix bypasses the broken module entirely by calling .NET classes directly: [System.IO.File]::GetAccessControl and X509Certificate2::CreateFromSignedFile. As a side benefit, the new implementation captures the raw SID instead of the friendly DOMAIN\Username — strictly better forensic value, because SIDs are stable across renames and domain re-joins, and forensic SIEMs key off SID.
That is the value proposition of an IR-grade test suite: not "did the code compile" but "does the forensic contract actually hold."
These are the things that are not yet there. We would rather tell you than have you find out in an incident.
Full forensic capture is Windows-only. Linux and macOS code paths exist and quarantine works, but the Windows-specific forensic data (Authenticode signatures, SDDL, NTFS MFT/ADS metadata, process tree via WMI) gracefully no-ops on non-Windows hosts. Cross-platform parity is a tracked roadmap item.
The AES-256-GCM defang key and HMAC log key are stored on disk in the vault root with ACL protection. A sufficiently-privileged attacker on the same host (admin / SYSTEM) could read them. For a hardware-rooted threat model, the keys would need to live in a TPM or HSM — that is a future enhancement, not currently implemented.
Each install generates its own ed25519 keypair. The bundle is verifiable against the embedded public key, but there is no chain to an external certificate authority. Adequate for internal handoff; not adequate for arms-length legal proceedings without additional notarization.
The system is designed to align with RFC 3227 spirit and NIST SP 800-86, but has not been formally audited against ISO/IEC 27037, FedRAMP, or any other certification regime. The court-defensible framing describes architectural intent, not certified status.
Timestamps come from the local system clock. No RFC 3161 trusted-timestamp authority integration. If the host clock is wrong or tampered with, quarantine timestamps reflect that.
The vault holds the artifact. Sandbox analysis is up to the operator. There is no built-in VM submission pipeline.
A pending request sits indefinitely until approved, denied, or cleared by toggling the gate off. A 24-hour auto-expire is the obvious next addition.
"The only IDE that ships a forensic-grade incident response quarantine vault. Chain-of-custody, tamper-evident logging, encrypted defang, and signed evidence bundles — exposed both as a UI and as agent tools."
Built for the developer wearing the security hat, or the security pro tired of stitching together six command-line tools to do what should be one right-click.
Buy Now — $79 ← Explore More Features