# Active response gating checklist

Work top to bottom. Any unticked box means the response stays off in that environment.
One environment at a time: passing this list for a lab tells you nothing about production.

## 1. The detection

- [ ] The triggering rule has produced findings for at least 14 days in this environment.
- [ ] Every finding in that window has been reviewed and classified as true or false positive.
- [ ] The false positive rate is zero over that window, not "low".
- [ ] The rule is pinned by `wazuh.rule.id` in the monitor query, not by severity alone.
- [ ] The rule is in the Custom space and under change control, so it cannot be silently widened.

## 2. The blast radius

- [ ] The monitor targets one findings data stream, not `wazuh-findings-v5-*`.
- [ ] Location is `Local` or `Defined agent`. `All` requires a written justification.
- [ ] The never-touch list covers domain controllers, jump hosts, load balancers, VPN and NAT
      egress addresses, the vulnerability scanner sources, the monitoring sources, and the
      addresses your own team administers from.
- [ ] The response cannot lock out the path used to recover the endpoint.
- [ ] Someone has answered: what happens if this fires on 500 agents in one minute?

## 3. The script

- [ ] Stateless or stateful is a deliberate choice, and stateful has a timeout you can live with.
- [ ] The action is idempotent.
- [ ] For stateful responses, the revert path has been tested independently of the enable path.
- [ ] The script exits non-zero only on genuine failure, so refusals do not look like errors.
- [ ] The script has run in dry-run mode against real findings and the log lines were checked.
- [ ] File permissions on the agent are `750`, ownership `root:wazuh` on Linux and macOS.

## 4. The operations

- [ ] There is a documented manual reversal for every action, usable without Wazuh.
- [ ] On-call knows the response exists, what it does, and how to switch it off.
- [ ] Switching it off is a single step: disable the monitor, or set
      `<active-response><disabled>yes</disabled>` on the agent.
- [ ] Executions are reviewed. The results land in `wazuh-active-responses*`, which the
      `stream-active-responses-policy` ISM policy keeps for 3 days by default; extend the policy
      or ship the records elsewhere if you need a longer audit trail.
- [ ] The change is recorded with an owner and a review date.

## 5. The rollout

- [ ] Enabled on a single non-critical agent group first.
- [ ] Left there for a full business cycle, including a month end and a patch window.
- [ ] Widened one group at a time, with the same review at each step.
- [ ] `repeated_offenders` considered, remembering it is set in the agent's local configuration
      only, cannot be distributed through `agent.conf`, and is not supported on Windows agents.

## Known failure modes to rehearse

| Failure | What it looks like | Prevention |
| --- | --- | --- |
| Blocking a shared egress address | One finding from a NAT gateway blocks a whole office or a whole customer | Never-touch networks; never act on addresses outside the asset inventory |
| Blocking the security team | The console stops answering from the office range | Never-touch list includes admin source ranges |
| Blocking a scanner | Authenticated scans start failing, coverage silently drops | Scanner sources on the never-touch list |
| Acting on a spoofed source | An attacker forges a source address to trigger a denial of service | Restrict to detections where the source cannot be trivially spoofed |
| Response on a domain controller | Authentication estate-wide degrades | Location `Local` plus group scoping; exclude tier-0 groups |
| Revert never runs | Stateful block becomes permanent after an agent restart | Test the disable branch; prefer short timeouts |
| Findings re-fire | The same finding triggers the response repeatedly | Idempotent actions; throttling on the monitor action |

Sources: the Wazuh 5.0-beta active response documentation and the Alerting module documentation.