AutoMode

With the AutoMode plan, InfraFence applies safe fixes by itself, around the clock, and asks you before anything risky. It picks only from a fixed catalog of actions and never runs commands of its own.

Before you use AutoMode or approve fixes: turn on two-factor authentication. Approving or rejecting what AutoMode asks, and applying a risky fix yourself, need an owner or admin of the organization signed in with two-factor authentication. Without it nobody can approve: the requests wait on Approvals and expire after 24 hours. While an owner or admin has no 2FA, the security score of every server also loses 5 points. Turn it on under Settings › Security: it takes a minute.

The catalog#

Restoring a quarantined file is in the catalog too, but only a person can ask for it.

What it does on its own#

• turns on port-scan bans, threat-list blocking and escalating bans;
• runs the scans every day;
• applies the hardening fixes that cannot lock anyone out, PHP's allow_url_include, display_errors and expose_php among them;
• closes a database or admin port (MySQL, PostgreSQL, Redis, MongoDB, Elasticsearch, Memcached, the Docker API, CouchDB, InfluxDB) that is open to the internet and was attacked in the last 24 hours;
• blocks outbound traffic to addresses on threat lists (critical matches), except destinations the server connects to regularly;
• bans for 24 hours an address on a threat list that connected to a service of the server and attacked it;
• applies virtual patches for exploited CVEs (Apache with ModSecurity);
• installs security updates inside your update window, one server at a time.

A ban needs 5 or more inbound events from the address within 24 hours, or a critical one. A match of a threat list counts as one of the 5, never as a critical one.

What needs your approval#

• hardening fixes that touch logins or can change how a site behaves, such as PHP's cgi.fix_pathinfo and disable_functions;
• updates of critical packages (OpenSSH, the C library, systemd, Docker, Kubernetes, databases, PAM, sudo, firewall tools, OpenSSL, networking);
• quarantining a file outside the web folders;
• closing any other port, for example MySQL's 3306 or PostgreSQL's 5432 when nothing attacked them in the last 24 hours (see Ports and egress blocking);
• a destination or virtual patch that does not meet the automatic conditions;
• blocking a destination the server connects to regularly (on 3 or more of the last 7 days), even on a threat list: it may be a service the server depends on (see Regular destinations);
• restoring a quarantined file.

The request appears on Approvals and in your alert channels. Approve or Reject it in the dashboard; deciding needs two-factor authentication, and the link in an alert only opens the request, so a forwarded message cannot approve anything. Requests nobody answers expire after 24 hours.

Deciding needs two-factor authentication. Only an owner or admin signed in with two-factor authentication can approve or reject: turn it on under Settings › Security before the first request arrives. Apply on a fix of the security score, by an owner or admin with 2FA, is already your decision and runs at once; without 2FA it becomes a request like AutoMode's.

When an Apply can't run, its message says why: the change is already in place (nothing to do; an extra protection that is on already is no longer suggested), your plan, your role, a session that has not passed two-factor authentication, a server or item that no longer exists, or a dashboard that can't be reached. A fix that becomes an approval request says so too.

What it never does#

• run a command of its own, or anything outside the catalog;
• ban whitelisted addresses, addresses on InfraFence's never-block list, your servers' addresses, or an address someone logged in from over SSH;
• block a country SSH logins come from;
• close an SSH port or a port a web server uses;
• redo something you undid;
• change servers in monitor mode: it notes what it would have done.

Limits: at most 50 actions per server per hour and 200 bans per organization per hour.

Checked, and undone if it breaks#

After every change the agent checks that SSH still accepts connections on every port it uses and that every monitored site still answers. If not, it rolls the change back by itself, and Activity shows Rolled back with the reason.

Activity and undo#

Activity lists everything AutoMode, the emergency mode and the fixes you applied did, newest first, with filters by source and status. Undo puts things back as they were; the server applies it within a minute. Installed updates cannot be undone.

Settings#

Under Settings › Agent, the AutoMode card:

• Pause AutoMode and Resume AutoMode: what was already applied stays.
• Update window: From, To and Time zone. Security updates are installed only between these hours. Outside the window, only the emergency mode installs updates, and only for vulnerabilities being exploited.

AI features send the events they need to Anthropic to produce their answer; see the security model.