Expected activity stays expected
Plugin, theme and core maintenance can appear as observed or verified-safe activity instead of contaminating the incident timeline.
Nexus Breach Command · powered by Sentinel
When isolated signals become a real incident, the response needs a command layer.
Breach Command correlates independent filesystem, runtime, integrity, persistence, identity and defense-evasion evidence so Nexus can distinguish ordinary change from a high-confidence compromise.
OBSERVELive compromise awareness.Expected maintenance and benign change stay distinguishable from incident evidence.
CORRELATEIndependent evidence matters.One noisy event does not automatically become a breach.
RESPONDBounded action, preserved evidence.Containment stays explicit, limited and reviewable.
REDLINE · emergency state
A serious incident should look different from everyday security noise.
REDLINE is entered only when supported compromise evidence becomes strong enough to justify an incident state. Nexus can preserve evidence, apply short-lived path-specific execution blocks, quarantine high-confidence malicious files after preservation and repair official WordPress core from a checksum-validated trusted package.
- Shadow mode remains the safe default
- Active mode is an explicit opt-in
- Containment uses per-incident budgets
- Quarantine is move-only, not deletion
- Recovery Validation is required before closure where appropriate
REDLINEACTIVE BREACH RESPONSE
High-confidence compromise response with evidence retained before disruptive action.
DetectPreserveContainValidate
Live Observation
Quiet operation is still visible.
Breach Command does not need to invent an incident to prove it is working.
Critical surface verification
High-value root files and critical drop-ins are checked independently of broad filesystem history limits.
Evidence correlation
Runtime, persistence, integrity and defense-evasion signals contribute independently before escalation.
Recovery stays deliberate
Supported response actions remain bounded while broader recovery decisions stay with the operator.
What Breach Command can do
- Preserve incident evidence before disruptive action
- Apply supported path-specific execution blocks
- Quarantine high-confidence malicious files after preservation
- Repair official WordPress core from exact trusted packages
- Keep local protection running if Controller delivery is unavailable
What Nexus deliberately does not promise
- No arbitrary database rewriting
- No silent administrator removal
- No automatic salt rotation
- No arbitrary premium/custom code replacement
- No promise of protection against full server/root compromise
Nexus PRO incident response
Security should know when the situation has changed.
Breach Command, REDLINE and Black Box are part of the licensed Nexus PRO incident-response stack.