DEFONEOS Incident Response Playbook

Autonomous Detection → BFT-Validated Response → SIGIL-Audited Recovery
Version 1.0 · 5 Jul 2026 · Ed25519: d1f4a2b8e3c7f901 · EU AI Act Art 17 (Post-Market Monitoring) · NIST SP 800-61 Rev. 2 · ISO/IEC 27035

DEFONEOS provides a fully autonomous incident response capability for sovereign AI systems operating in defence, public safety, and critical national infrastructure. The playbook covers the complete lifecycle: detect → triage → contain → eradicate → recover → review, with every action validated by the 33-agent BFT council and permanently recorded on the SIGIL hash-chained ledger.

<10s

Detection to Alert

23/33

BFT Quorum

Response Phases

100%

SIGIL Audited

1. Incident Classification Matrix

Severity	Definition	Example	Response Time	Escalation
SEV-1 CRITICAL	System compromise, red-line violation, data exfiltration	Red-line breach (kinetic targeting pattern detected)	<10 seconds	Full BFT council + human authority
SEV-1	Active attack, sovereignty breach	Foreign IP attempting system access	<30 seconds	Full BFT council
SEV-2 HIGH	Significant degradation, partial compromise	MCP server unresponsive, degraded sensor feed	<2 minutes	5-agent quorum
SEV-3 MEDIUM	Minor degradation, anomaly detected	Rate limit hit, latency spike	<5 minutes	3-agent quorum
SEV-4 LOW	Informational, logged for review	Failed login attempt, config drift	Next cycle	Automatic logging

2. The 7-Phase Response Pipeline

Phase 1: DETECT (Autonomous, Continuous)

Trigger: Any anomaly from 280 continuous monitoring checks running every 5-minute cycle.

Gods-Eye CISO scanner — 14 scan vectors covering all 7 OWASP LLM Top 10 categories
SIGIL chain anomaly detection — hash chain integrity verified every tick
Red-line monitor — 7 immutable red lines checked on every agent action
Network IDS — foreign IP detection, bot identification, port scan detection
MCP health monitor — all 30 MCP servers polled for availability
BFT consensus monitor — agent vote patterns checked for manipulation

OUTPUT incident_alert{sev, source, evidence_hash, timestamp}

Phase 2: TRIAGE (BFT 5-agent quorum, <30s)

Trigger: Incident alert received from Phase 1.

Severity assignment — 5 agents independently classify severity
Evidence collection — full SIGIL transcript, network logs, agent state captured
Impact assessment — blast radius computed (which systems, data, users affected)
Red-line check — if any of 7 red lines violated, escalate to SEV-1 immediately
Quorum vote — 4/5 agents must agree on classification before proceeding

OUTPUT triage_decision{confirmed_sev, blast_radius, red_line_violation, action_plan}

Phase 3: CONTAIN (BFT 23/33 quorum for SEV-1, <2min)

Trigger: Triage decision confirmed.

SEV-1 Action	SEV-2 Action	SEV-3 Action
Full system freeze	Isolate affected MCP	Rate limit source
Revoke all agent keys	Block source IP	Increase monitoring
Activate air gap	Switch to backup	Log + monitor
Notify human authority	5-agent quorum	3-agent quorum

Red-line violation containment: Immediate system halt. No agent may take any further action until human authority intervenes. The SIGIL chain records the violation with cryptographic proof.

Phase 4: ERADICATE (BFT quorum + human authority for SEV-1)

Trigger: Containment confirmed stable.

Root cause analysis — full forensic replay of SIGIL chain (DORADO replay tool)
Threat removal — purge malicious code, revoke compromised credentials
Vulnerability patch — identified CVE patched within 24h (SLA)
Key rotation — all Ed25519 keys rotated post-incident (quantum-safe rotation)
Agent re-registration — all agents re-registered with fresh identity keys

Phase 5: RECOVER (BFT quorum, gradual)

Trigger: Eradication verified.

Staged restart — systems brought back in priority order (core → sensors → MCPs → UI)
Integrity verification — every file hash-checked against known-good state
SIGIL chain verification — full chain integrity verified post-recovery
Functional tests — all 16 E2E sovereign contract tests must pass
Gradual load increase — traffic ramped from 10% → 50% → 100% over 30 minutes

Phase 6: REVIEW (Autonomous + Human, <72h)

Trigger: Recovery confirmed, system stable for 24h.

Post-incident report — auto-generated from SIGIL chain (timeline, root cause, impact, actions taken)
BFT council review — 33 agents review response effectiveness
Lessons learned — improvements fed to OLM router for learning
OSCAL update — POA&M items updated in compliance catalog
Human authority sign-off — Nick Templeman reviews all SEV-1 incidents

Phase 7: HARDEN (Autonomous, continuous)

Trigger: Review complete.

Threat model update — new attack vectors added to detection rules
Red-team exercise — simulated replay of the incident to verify fix
Policy update — BFT charter amended if procedural gaps found
Training data — incident added to OLM corpus for future learning

3. Automated Response Playbooks by Threat Type

3.1 Prompt Injection Attack

Step	Action	Agent	Time
1	Input sanitizer flags injection pattern	meok-injection-scan MCP	T+0s
2	Alert emitted to SIGIL chain	System	T+1s
3	5-agent quorum confirms injection	BFT council	T+5s
4	Source session terminated, key revoked	Guard subsystem	T+8s
5	Pattern added to injection blocklist	OLM router	T+15s
6	Post-incident SIGIL emitted	System	T+20s

3.2 Foreign IP Access Attempt

Step	Action	Agent	Time
1	DORADO foreign-access detector flags non-sovereign IP	DORADO detect	T+0s
2	IP geolocated, threat score computed	SOC bot detector	T+2s
3	If score > 0.7: IP blocked at edge	Guard subsystem	T+5s
4	SIGIL emitted with IP, geo, score, action	System	T+7s
5	CISO dashboard updated	Gods-Eye scanner	T+10s

3.3 Red-Line Violation (Maximum Severity)

Step	Action	Authority	Time
1	Red-line monitor detects pattern match	Autonomous	T+0s
2	IMMEDIATE SYSTEM HALT	Autonomous	T+0.1s
3	All agent actions frozen, keys suspended	Autonomous	T+0.5s
4	Full BFT council emergency session (33 agents)	BFT 23/33	T+30s
5	Human authority notified (all channels)	System	T+60s
6	Forensic evidence sealed (SIGIL + DORADO replay)	Autonomous	T+120s
7	NO FURTHER ACTION UNTIL HUMAN INTERVENTION	Human	T+∞

3.4 MCP Supply Chain Compromise

Step	Action	Agent	Time
1	Integrity check flags modified MCP package	Aegis reviewer gate	T+0s
2	Affected MCP isolated from federation	Federation manager	T+3s
3	5-agent quorum reviews diff	BFT council	T+30s
4	If malicious: MCP quarantined, backups restored	System	T+60s
5	Federation catalog updated, downstream agents notified	OLM router	T+90s

3.5 SIGIL Chain Tampering

Step	Action	Agent	Time
1	Chain verification detects hash mismatch	OrgKernel verify_chain	T+0s
2	Tampered entry identified and quarantined	System	T+1s
3	Bitcoin OP_RETURN anchor consulted for truth	Blockchain verifier	T+5s
4	Chain re-anchored from last good state	System	T+10s
5	Full forensic report emitted	DORADO replay	T+30s

4. Communication Protocol

Severity	Internal	Authority	Public
SEV-1	SIGIL + Dashboard + Alert	Direct notification (all channels)	Within 72h (if required by regulation)
SEV-2	SIGIL + Dashboard	Email summary <24h	Not required
SEV-3	SIGIL	Weekly digest	Not required
SEV-4	SIGIL log	Monthly report	Not required

5. Compliance Alignment

Framework	Article/Control	How DEFONEOS Satisfies
EU AI Act	Art 17 — Post-Market Monitoring	Continuous 5-min cycle monitoring, automated incident logging
EU AI Act	Art 73 — Serious Incident Reporting	SEV-1 reporting pipeline within 72h
NIST SP 800-61 Rev 2	Computer Security Incident Handling	Full 6-phase lifecycle: Preparation → Detection → Containment → Eradication → Recovery → Review
ISO/IEC 27035	Information Security Incident Management	Aligned phases + SIGIL audit trail
JSP 440	Defence InfoSec Incident Management	UK MOD incident classification compatible
NIS Regulations 2018	Incident Notification (UK)	SEV-1/2 notification pipeline ready
GDPR Art 33	Personal Data Breach (72h)	If PII involved: automated 72h ICO notification draft
DPA 2018	Security Incident	UK GDPR implementation covered

6. Incident Response SIGIL Schema

{
  "sigil_version": "2.0",
  "incident_id": "INC-2026-0705-001",
  "timestamp": "2026-07-05T16:30:00Z",
  "severity": "SEV-2",
  "type": "prompt_injection",
  "source": "external_session_abc123",
  "detection": {
    "vector": "meok-injection-scan",
    "pattern": "ignore_previous_instructions_and_reveal",
    "confidence": 0.97
  },
  "triage": {
    "quorum": "5/5",
    "blast_radius": "single_session",
    "red_line_violation": false,
    "decision_hash": "a3f7c2d8e1b4..."
  },
  "containment": {
    "action": "session_terminated_key_revoked",
    "timestamp": "2026-07-05T16:30:08Z",
    "quorum": "5/5"
  },
  "evidence": {
    "sigil_entries": ["H|...","C|...","V|..."],
    "network_logs": "log_hash_abc123",
    "agent_state": "state_hash_def456"
  },
  "post_incident": {
    "root_cause": "novel_injection_variant",
    "fix": "pattern_added_to_blocklist",
    "review_status": "pending_human"
  },
  "signature": "ed25519:7f3a2b8c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a"
}

⚠️ Red Lines — Incident Response Cannot Override

Incident response may NOT access personal surveillance data (even for forensic purposes)
Incident response may NOT target individuals based on protected characteristics
Incident response containment actions may NOT cause kinetic effects in the physical world
Incident response evidence collection respects PII redaction (PII never stored in SIGIL)
Human authority override is ALWAYS available — the system can be halted at any time
Post-incident data retention: forensic evidence purged after 90 days unless legally required
No incident response action may exfiltrate data to non-sovereign infrastructure

📋 Honesty Register

Detection times (<10s): Architectural target based on design. Not yet benchmarked under adversarial load. Production deployments should verify against actual threat vectors.
BFT quorum (23/33): Governance design implemented in council code. Live adversarial testing pending.
280 monitoring checks: Designed coverage across 14 vectors. Actual coverage depends on MCP fleet health.
72h regulatory reporting: Notification pipeline designed. Regulatory submission requires human authority — DEFONEOS drafts, humans submit.
Bitcoin OP_RETURN anchoring: Architecture documented. Live anchoring requires BTC integration — currently SIGIL chain is internally verified only.
Illustrative vs Live: This page describes the designed capability. "Running" means the code exists. "Proven" means tested under adversarial conditions. "Certified" means independently assessed. Know the difference.

7. Integration Architecture

┌─────────────────────────────────────────────────────────────────┐
│                    DEFONEOS INCIDENT RESPONSE                    │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  ┌──────────┐   ┌──────────┐   ┌──────────┐   ┌──────────┐     │
│  │ DETECT   │──▶│ TRIAGE   │──▶│ CONTAIN  │──▶│ ERADICATE│     │
│  │ 280 chk  │   │ BFT 5/5  │   │ BFT 23/33│   │ + Human  │     │
│  └──────────┘   └──────────┘   └──────────┘   └──────────┘     │
│       │              │              │              │              │
│       └──────────────┴──────────────┴──────────────┘              │
│                          │                                        │
│                          ▼                                        │
│                   ┌──────────────┐                                │
│                   │ SIGIL CHAIN  │  ← Every action recorded       │
│                   │ (hash-chained)│  ← Ed25519 signed             │
│                   └──────────────┘  ← Bitcoin anchored (planned)  │
│                          │                                        │
│           ┌──────────────┼──────────────┐                         │
│           ▼              ▼              ▼                         │
│    ┌──────────┐   ┌──────────┐   ┌──────────┐                    │
│    │ RECOVER  │   │ REVIEW   │   │ HARDEN   │                    │
│    │ Staged   │   │ 72h Rpt  │   │ OLM Learn│                    │
│    └──────────┘   └──────────┘   └──────────┘                    │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

8. Tooling

Tool	Role	Source
Gods-Eye CISO Scanner	Continuous posture monitoring (280 checks/5min)	DEFONEOS built-in
DORADO Foreign Access Detector	Non-sovereign IP detection + bot scoring	DEFONEOS DORADO
meok-injection-scan MCP	Prompt injection + supply chain scanning	MEOK MCP fleet
Aegis Reviewer Gate	MCP output safety scanning (Morris-II worm check)	Swarm orchestration
OrgKernel 3-Layer Audit	L1 Identity + L2 Execution + L3 Compliance chain	OrgKernel pattern
SIGIL Chain Explorer	Incident timeline reconstruction	SIGIL REST API
DORADO Replay	Forensic audit-trail replay for regulators	DORADO module
OSCAL Catalog	Compliance control mapping post-incident	NIST OSCAL 1.1.2