Respond to an incident · Vardhold docs

When an agent does something it should not, Vardhold gives you a way to stop everything in one action, then the tools to contain one agent, collect evidence and recover.

Stop everything now Right-click the tray icon → Emergency stop (kill switch), use Kill switch at the top of the dashboard, or from any prompt run vardhold killswitch engage. Engaging needs no administrator, so anyone at the PC can do it.

Stop#

The kill switch acts at once:

Every checked agent action is blocked, whatever the policy says.
Every pending approval is denied.
Every running agent and its child processes are suspended, frozen with their memory intact for investigation.
Their network access is blocked, where the Windows Defender Firewall is available.

To end the agent processes instead of freezing them, use vardhold killswitch terminate.

Contain one agent#

If you know which agent is involved, contain it alone and let everything else carry on. On the dashboard's Agents page, or with the local API:

Action	Effect	Confirmation
Suspend	Freezes the agent's processes	None
End	Ends the agent's processes	None
Block network	Adds outbound Windows Defender Firewall rules for the agent's executables, in a group named `Vardhold: <agent>`	None
Set trust to blocked	Denies every checked action from the agent	None
Resume, unblock, restore trust	Undo the above	Administrator

Each action is checked first: system and security processes, shared runtimes such as node and python, browsers and Vardhold itself are refused, and every process is re-checked so a reused process id is never hit.

Tighten#

While you investigate, switch to strict mode: checked actions that no rule matches need approval, and rules with a verdict_strict tighten.

PowerShell

vardhold mode strict

Collect evidence#

Check the audit log, against the SIEM's copy of the chain head where you have one:
PowerShell
```
vardhold verify --anchor <id>:<hash>
```
Exit code 0 means intact; 4 means the check failed and the output says what was found.

Export the events for the time window and agent:

PowerShell

vardhold export --format ocsf --from "2026-10-15 09:00" --agent cursor --output .\incident.ndjson

Keep a copy of the database if the machine will be reimaged. vardhold verify --offline --db <copy> checks a copy without the service.

The timeline shows each event's agent, process, target, rule and verdict, and whether it was prevented or seen after it happened.

Recover#

Fix the cause: tighten the policy, remove the MCP server, or block the agent.
Release the kill switch. This needs administrator confirmation:
PowerShell
```
vardhold killswitch release
```
Return to enforce mode and resume or end suspended agents.

Prepare before you need it#

Write down who may engage and release the kill switch, and how to reach them.
Send events to your SIEM so evidence survives the endpoint.
Decide whether headless agents should be suspended automatically when telemetry detects a blocked action (autoSuspendOnDetectBlock).