GUIDES · RESPOND
Reversing a contain action safely.
Every containment action records its inverse, so undo is a single call. Doing it safely means more than calling rollback — it means verifying the world actually returned to where you expected before you close the case.
The inverse model
When an action runs, it writes its inverse to the case timeline. Reversal replays that inverse — there is no guessing what “undo” means, because the action told you when it ran.
| Action | Inverse |
|---|---|
isolate-host | release-host |
disable-actor | enable-actor |
revoke-token | reissue-token (new credential; the old stays dead) |
block-domain | unblock-domain |
Reverse one action
Roll back a single action by id, or reverse every action in a case at once when you have confirmed a false positive.
SHELLrollback $ td contain rollback act_9bc01 -> inverse: release-host on h_47193 -> EDR confirmed host rejoined network ok reversed . recorded as act_9bd02 on case_7Qd2 $ td case rollback case_7Qd2 # reverse the whole case -> 3 actions . 3 inverses applied . 0 failures
Verify it landed
An inverse that returns success means the request was accepted, not that the world is healthy. Confirm the actual end state before you call it done.
Reissue is not un-revoke. Revoking a token kills it permanently; the inverse mints a new credential and rotates it in. Make sure the consuming service picked up the new token before you close the case, or you have traded a security event for an outage.
Where to go next
- Response engine — how reversibility is guaranteed.
- API reference — the containment endpoints.