Incident response (IR)
When a triaged alert warrants action, Mobius can respond — not just notify. The response layer executes through the Wazuh Manager's Active Response API on the affected agent, using the same connector session that reads your alerts (its one explicitly-gated write path).
The v1 action: block the attacker IP
The first supported action is an IP block on the affected agent —
firewall-drop on Linux agents, netsh on Windows — executed by the Wazuh
agent itself via Active Response. The action model is action-keyed, so
further actions (for example, disabling an account) slot in without a
redesign.
Two modes
| Mode | Behavior |
|---|---|
| Approval-first (default) | The proposed action appears as a pending approval: who, what, why, and the evidence. An analyst approves or rejects it. |
| Automatic | For rules and severities you designate, the block executes immediately and the console records it. |
Every execution — automatic or approved — lands in the audit trail with the triggering incident, the exact command, the target agent, and the outcome.
Setting it up
IR is off by default and configured per environment:
- Enable it on an environment. On the response page, click Enable Incident Response and pick an environment — only connector environments whose Wazuh Manager is reachable are offered. You can also enable it directly from the environment card. Flip the toggle on.
- Choose the mode. Once enabled, the card reveals the Block IP action with a three-way switch: Disabled (the action never fires), Auto (a matching alert is blocked immediately), or Manual (a matching alert becomes a pending approval in the response queue, plus a bell notification). The block always targets the affected agent only.
- Approve or ignore (Manual). A pending card shows the alert, source IP, and agent. Execute sends the block; Ignore dismisses it.
Tracking actions in History
The moment an action is sent (auto or approved) it moves to History as Launched — Mobius does not wait on further confirmation. A send the manager or connector rejects shows as Failed with the reason; dismissed approvals show as Ignored. Filter History by environment with the selector.
IR is per-environment and never touches environments where it is off. The card's readiness line and the IR On / Off badge on the environment card reflect whether the Wazuh Manager is reachable.
Safety properties
- No new exposure. The Wazuh Manager API (
:55000) is reached locally by the connector on your node — nothing new listens anywhere. - Explicitly gated. The connector's query router is read-only by design; the response call is a separate, allowlisted operation.
- Reversible. IP blocks are Wazuh Active Response actions with the standard timeout/undo semantics your deployment already uses.
IR is configured per environment: enable it, choose approval-first or automatic per severity, and set who gets the approval notifications — see Notifications.