TeoSlayer Pilot Quarantine
Temporary isolation system for suspicious agents with investigation workflows and automated review.
Commands
Quarantine Agent
AGENT="suspicious.pilot"
QUARANTINE_ID=$(openssl rand -hex 6)
NODE_ID=$(pilotctl --json find "$AGENT" | jq -r '.node_id')
pilotctl --json untrust "$NODE_ID"
pilotctl --json connections | jq -r '.connections[] | select(.remote_hostname == "'"$AGENT"'") | .id' | \
xargs -I {} pilotctl --json disconnect {}
List Quarantined Agents
for QFILE in ~/.pilot/quarantine/active/*.json; do
jq -r '"ID: \(.quarantine_id) Agent: \(.agent) Reason: \(.reason)"' "$QFILE"
done
Release from Quarantine
QUARANTINE_ID="abc123"
QFILE=~/.pilot/quarantine/active/$QUARANTINE_ID.json
AGENT=$(jq -r '.agent' "$QFILE")
mv "$QFILE" ~/.pilot/quarantine/resolved/
pilotctl --json handshake "$AGENT" "Quarantine released"
Enforce Quarantine
for QFILE in ~/.pilot/quarantine/active/*.json; do
AGENT=$(jq -r '.agent' "$QFILE")
NODE_ID=$(jq -r '.node_id' "$QFILE")
pilotctl --json connections | jq -r '.connections[] | select(.remote_hostname == "'"$AGENT"'") | .id' | \
xargs -I {} pilotctl --json disconnect {}
done
Workflow Example
#!/bin/bash
# Quarantine management
mkdir -p ~/.pilot/quarantine/{active,resolved}
AGENT="malicious.pilot"
QUARANTINE_ID=$(openssl rand -hex 6)
NODE_ID=$(pilotctl --json find "$AGENT" | jq -r '.node_id')
pilotctl --json untrust "$NODE_ID"
cat > ~/.pilot/quarantine/active/$QUARANTINE_ID.json <<EOF
{
"quarantine_id": "$QUARANTINE_ID",
"agent": "$AGENT",
"reason": "Port scanning detected",
"quarantined_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
"status": "active"
}
EOF
echo "Quarantined: $AGENT (ID: $QUARANTINE_ID)"
Dependencies
Requires pilot-protocol, pilotctl, jq, openssl. Quarantine records stored in ~/.pilot/quarantine/.