An affected file or request
A report download is checked against the requester's authority, the current request state and the recorded file.
Capability 06 / Ardamire Defense Layer
Protect the work Keep recovery accountable
Ardamire is Auxtho's implemented internal defence layer. It checks identity, authority and request state in connected processing paths, links problems to specific files or operations, and keeps investigation and authorised recovery with the same case.
Operators can see what stopped, why it stopped and who authorised recovery, without losing the original record.
The job in plain language
Investigate the exception Restore permitted work
Identity and request checks, targeted holds, evidence and recovery history stay connected. Consequential decisions remain with authorised people.
Checks, targeted holds and case records
Failed checks stop the affected request. Related signals, hold reasons and execution evidence support investigation in the internal Console.
Whether recovery is authorised
An authorised operator checks the current target and hold before releasing quarantine. File recovery and incident closure are separate decisions.
Investigation and re-examination
Watch gathers case-scoped evidence candidates and handoff records for operator review. Ardamire Agent explains supported Console screens and the next checks. Replay Entry leads to review and separate Lab re-execution.
The original record and recovery history
Target, reason, operator and time remain linked to the incident. Separate replay results can be compared without replacing the original record or approval.
Public modeled signal scenario
Investigate first Decide explicitly Verify before rollout
This six-stage illustration explains the path from a security signal to investigation, a proposed change, human review and verification. The linked animation walks through this model. Dated implementation and test records are available on the Ardamire product page.
A security signal enters the defensive control path.
The affected path enters a hold while the signal is investigated.
Signal, artifact, and policy context are assembled for review.
A defensive change is prepared as a proposal, not executed.
An accountable person decides whether the proposal advances.
The approved proposal enters verification before rollout.
Source note
The Ardamire product page presents implemented controls and first-party test records. The October 12–13 records use synthetic data and summarise separate tests. The security evidence page provides recorded tests and a separately labelled illustrative sequence.