Runbooks

These runbooks are for security and incident responders working in Axiom Control. Each one is a sequence of concrete steps against the real console screens and API endpoints. They assume you hold incident.respond (organisation administrator or security policy administrator) in the affected organisation, and evidence.export for bundle and receipt exports.

Situation	Runbook
An agent misbehaves or must be stopped now	Disabled agents
A private key was lost, leaked or is suspected	Lost or compromised keys
A customer-hosted gateway stops reporting	Unreachable gateways
Someone asks "where is the receipt?"	Missing receipts
The incident is over and access must come back	Safe release after containment
The SIEM missed events or shows a failure	SIEM recovery

Calling the Control API from a terminal

Every step names the console screen first. When you script a step, call the same endpoint the console calls. Console calls are authenticated with the session cookie axiom_session and, on every unsafe method (POST, PATCH, PUT, DELETE), the x-axiom-csrf header carrying the CSRF token returned at sign-in (GET /auth/session returns it as csrf_token).

export AXIOM_API=https://api.sectigoaxiom.com
export AXIOM_SESSION='…'   # value of the axiom_session cookie
export AXIOM_CSRF='…'      # csrf_token from GET /auth/session
export ORG=org_…

axiom_post() { # axiom_post PATH JSON
  curl -sS -X POST "$AXIOM_API$1" \
    -H "cookie: axiom_session=$AXIOM_SESSION" -H "x-axiom-csrf: $AXIOM_CSRF" \
    -H 'content-type: application/json' -d "$2"
}
axiom_get() { curl -sS "$AXIOM_API$1" -H "cookie: axiom_session=$AXIOM_SESSION"; }

A caller who cannot see a resource gets 404 not_found, never 403, so a typo in an ID and a missing permission look the same. Check the ID and your role before concluding that something does not exist.

The first step is always search

Console: Incidents → search box (/control/orgs/:oid/incidents).

axiom_post /v1/orgs/$ORG/search '{"q":"agt_01…"}'

q can be an agent ID, a credential ID or thumbprint, a grant, a tenant, a customer name or an action ID. The response groups agents[], credentials[], grants[] (with descendants), gateways[] and actions[] (in-flight first). Each entry carries the actor, the original sponsor, the approval source and the last confirmed state, plus query and matches[] saying what the query matched. Results are bounded to your organisation: its projects and tenants, and outside identities only where they hold grants on, or acted on, your organisation's services.