Tiered Quarantine Management System Design

Created: 2025-12-17 Status: Draft Author: CyberOrigen Team

Overview

A scalable quarantine management system that distributes file review responsibility across tenant admins, AI agents, and automated rules, with platform admin oversight for escalations and global policy.

Architecture

┌─────────────────────────────────────────────────────────────────────────────┐
│                           QUARANTINE PIPELINE                                │
└─────────────────────────────────────────────────────────────────────────────┘

     File Upload
          │
          ▼
┌─────────────────┐
│  ClamAV + OTX   │ ← Primary scan (signatures, threat intel)
│    Scanner      │
└────────┬────────┘
         │
    ┌────┴────┐
    ▼         ▼
 CLEAN    FLAGGED
   │          │
   ▼          ▼
 Allow   ┌─────────────────┐
         │   QUARANTINE    │
         │     QUEUE       │
         └────────┬────────┘
                  │
                  ▼
         ┌─────────────────┐
         │   AI TRIAGE     │ ← Secondary analysis (code, content, context)
         │     AGENT       │
         └────────┬────────┘
                  │
    ┌─────────────┼─────────────┐
    ▼             ▼             ▼
┌────────┐  ┌──────────┐  ┌──────────┐
│ AUTO   │  │  AUTO    │  │  HUMAN   │
│RELEASE │  │  DELETE  │  │  REVIEW  │
│ (95%+  │  │ (95%+    │  │ (50-95%) │
│ clean) │  │ malicious│  │          │
└────────┘  └──────────┘  └─────┬────┘
                                │
              ┌─────────────────┼─────────────────┐
              ▼                 ▼                 ▼
        ┌──────────┐     ┌──────────┐     ┌──────────┐
        │  TENANT  │     │ PLATFORM │     │ SECURITY │
        │  ADMIN   │     │  ADMIN   │     │   TEAM   │
        │  Queue   │     │  Queue   │     │  Queue   │
        └──────────┘     └──────────┘     └──────────┘
              │                 │                 │
              └─────────────────┴─────────────────┘
                                │
                                ▼
                    ┌─────────────────────┐
                    │  FINAL DISPOSITION  │
                    │  Release / Delete   │
                    └─────────────────────┘

Responsibility Tiers

Tier 1: Automated Actions (No Human Intervention)

Condition	Action	Logging
AI confidence ≥95% clean + no ClamAV signature	Auto-release	Log: "AI auto-released, confidence: X%"
AI confidence ≥95% malicious OR known malware signature	Auto-delete	Log: "Auto-deleted, threat: X" + notify uploader
File in quarantine >30 days, no review	Auto-delete	Log: "Expired, auto-deleted" + notify uploader
File hash matches previously approved file	Auto-release	Log: "Hash trusted, auto-released"
File hash matches previously rejected file	Auto-delete	Log: "Hash blocked, auto-deleted"

Tier 2: Tenant Admin Review

Tenant admins review quarantined files from their own organization.

Sees:

Files uploaded by users in their organization
AI analysis summary and recommendation
Threat details from ClamAV/OTX
File metadata (uploader, timestamp, context)

Can:

Release file (with optional "trust this hash" flag)
Delete file (with optional "block this hash" flag)
Escalate to Platform Admin
Request deeper AI analysis

Cannot:

Modify global rules
See other organizations' quarantined files
Override Platform Admin blocks

Tier 3: Platform Admin

Platform admin handles escalations and sets global policy.

Sees:

All escalated files across tenants
Global quarantine statistics
Rule effectiveness metrics
AI performance metrics

Can:

Review/release/delete any quarantined file
Create/modify global auto-action rules
Block file hashes platform-wide
Adjust AI confidence thresholds
Override tenant admin decisions
Configure per-tenant quarantine policies

Tier 4: Security Team (Optional)

For high-severity threats or advanced analysis.

Triggers:

AI detects potential zero-day or APT indicators
Multiple tenants flag same file
File exhibits evasion techniques
Tenant admin requests expert review

AI Agent Design

Agent Capabilities

yaml

name: QuarantineAnalysisAgent
description: Analyzes quarantined files and recommends disposition

tools:
  - read_file_content      # For text-based files
  - extract_file_metadata  # Size, type, timestamps, hashes
  - check_virus_total      # Optional: external threat intel
  - check_otx_indicators   # AlienVault OTX lookup
  - analyze_code_patterns  # For scripts/source code
  - check_hash_reputation  # Internal + external hash DBs

analysis_types:
  - static_code_analysis   # Scripts, source code
  - macro_extraction       # Office documents
  - url_extraction         # Embedded URLs/domains
  - string_analysis        # Suspicious strings, encoded data
  - metadata_analysis      # EXIF, document properties
  - behavioral_hints       # File naming, obfuscation patterns

Analysis Output Schema

typescript

interface QuarantineAnalysis {
  file_id: string;
  analysis_timestamp: string;

  // Confidence scores (0-100)
  confidence: {
    clean: number;      // Probability file is safe
    suspicious: number; // Probability file is suspicious
    malicious: number;  // Probability file is malicious
  };

  // AI recommendation
  recommendation: 'auto_release' | 'auto_delete' | 'human_review';
  recommendation_reason: string;

  // Detailed findings
  findings: {
    category: string;           // e.g., "obfuscated_code", "suspicious_url"
    severity: 'low' | 'medium' | 'high' | 'critical';
    description: string;
    evidence: string;           // Code snippet, URL, etc.
    mitre_attack_id?: string;   // e.g., "T1059.001"
  }[];

  // File classification
  file_analysis: {
    detected_type: string;      // Actual type vs extension
    type_mismatch: boolean;     // Extension doesn't match content
    entropy_score: number;      // High entropy = possible encryption/packing
    embedded_files: string[];   // Nested archives, OLE objects
    extracted_urls: string[];
    extracted_ips: string[];
    extracted_domains: string[];
  };

  // For code files
  code_analysis?: {
    language: string;
    suspicious_functions: string[];  // eval, exec, shell commands
    obfuscation_detected: boolean;
    network_operations: boolean;
    file_operations: boolean;
    process_operations: boolean;
  };
}

AI Decision Matrix

┌─────────────────────────────────────────────────────────────────┐
│                    AI DECISION MATRIX                           │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  Clean Confidence                                               │
│        │                                                        │
│   100% ┼─────────────────────────────────┐                      │
│        │         AUTO-RELEASE            │                      │
│    95% ┼─────────────────────────────────┤                      │
│        │                                 │                      │
│        │       HUMAN REVIEW              │                      │
│        │    (Tenant Admin Queue)         │                      │
│    50% ┼─────────────────────────────────┤                      │
│        │                                 │                      │
│        │       HUMAN REVIEW              │                      │
│        │   (Escalate if high severity)   │                      │
│     5% ┼─────────────────────────────────┤                      │
│        │         AUTO-DELETE             │                      │
│     0% ┼─────────────────────────────────┘                      │
│        │                                                        │
│        └────────────────────────────────────► Malicious Score   │
│             0%                      100%                        │
└─────────────────────────────────────────────────────────────────┘

Database Schema

quarantine_items

sql

CREATE TABLE quarantine_items (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    organization_id UUID NOT NULL REFERENCES organizations(id),

    -- File info
    original_filename VARCHAR(255) NOT NULL,
    stored_filename VARCHAR(255) NOT NULL,  -- Sanitized name in quarantine storage
    file_size BIGINT NOT NULL,
    mime_type VARCHAR(100),
    file_hash_sha256 VARCHAR(64) NOT NULL,
    file_hash_md5 VARCHAR(32),

    -- Upload context
    uploaded_by UUID REFERENCES users(id),
    upload_context VARCHAR(50),  -- 'audit_evidence', 'scan_upload', etc.
    upload_context_id UUID,      -- Reference to audit, scan, etc.

    -- Scanner results
    clamav_result JSONB,
    otx_result JSONB,
    initial_threat_name VARCHAR(255),
    initial_severity VARCHAR(20),  -- 'suspicious', 'malicious'

    -- AI analysis
    ai_analysis JSONB,
    ai_confidence_clean INTEGER,
    ai_confidence_malicious INTEGER,
    ai_recommendation VARCHAR(20),  -- 'auto_release', 'auto_delete', 'human_review'
    ai_analyzed_at TIMESTAMP WITH TIME ZONE,

    -- Status
    status VARCHAR(20) NOT NULL DEFAULT 'pending',
    -- 'pending', 'ai_reviewing', 'awaiting_review', 'released', 'deleted', 'escalated'

    -- Review tracking
    assigned_to UUID REFERENCES users(id),
    assigned_tier VARCHAR(20),  -- 'tenant_admin', 'platform_admin', 'security_team'
    escalated_from UUID REFERENCES users(id),
    escalation_reason TEXT,

    -- Resolution
    resolved_by UUID REFERENCES users(id),
    resolved_at TIMESTAMP WITH TIME ZONE,
    resolution VARCHAR(20),  -- 'released', 'deleted', 'expired'
    resolution_reason TEXT,
    trust_hash BOOLEAN DEFAULT FALSE,  -- Add to trusted hashes
    block_hash BOOLEAN DEFAULT FALSE,  -- Add to blocked hashes

    -- Timestamps
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    expires_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() + INTERVAL '30 days'
);

CREATE INDEX idx_quarantine_org ON quarantine_items(organization_id);
CREATE INDEX idx_quarantine_status ON quarantine_items(status);
CREATE INDEX idx_quarantine_hash ON quarantine_items(file_hash_sha256);
CREATE INDEX idx_quarantine_expires ON quarantine_items(expires_at);

quarantine_hash_list

sql

CREATE TABLE quarantine_hash_list (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    file_hash_sha256 VARCHAR(64) NOT NULL UNIQUE,

    list_type VARCHAR(20) NOT NULL,  -- 'trusted', 'blocked'
    scope VARCHAR(20) NOT NULL,       -- 'global', 'organization'
    organization_id UUID REFERENCES organizations(id),  -- NULL for global

    reason TEXT,
    added_by UUID REFERENCES users(id),
    source VARCHAR(50),  -- 'manual', 'ai_recommendation', 'quarantine_resolution'

    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    expires_at TIMESTAMP WITH TIME ZONE  -- NULL = permanent
);

CREATE INDEX idx_hash_list_hash ON quarantine_hash_list(file_hash_sha256);
CREATE INDEX idx_hash_list_type ON quarantine_hash_list(list_type);

quarantine_rules

sql

CREATE TABLE quarantine_rules (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),

    name VARCHAR(100) NOT NULL,
    description TEXT,

    scope VARCHAR(20) NOT NULL,  -- 'global', 'organization'
    organization_id UUID REFERENCES organizations(id),

    -- Rule conditions (JSONB for flexibility)
    conditions JSONB NOT NULL,
    /*
    Example conditions:
    {
      "file_type": ["exe", "dll", "scr"],
      "ai_confidence_clean_gte": 95,
      "clamav_signature_match": false,
      "file_age_days_gte": 30
    }
    */

    -- Rule action
    action VARCHAR(20) NOT NULL,  -- 'auto_release', 'auto_delete', 'escalate', 'assign'
    action_params JSONB,
    /*
    Example action_params:
    {
      "assign_to_tier": "platform_admin",
      "notify_uploader": true,
      "trust_hash": true
    }
    */

    priority INTEGER DEFAULT 100,  -- Lower = higher priority
    enabled BOOLEAN DEFAULT TRUE,

    created_by UUID REFERENCES users(id),
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);

quarantine_audit_log

sql

CREATE TABLE quarantine_audit_log (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    quarantine_item_id UUID NOT NULL REFERENCES quarantine_items(id),

    action VARCHAR(50) NOT NULL,
    -- 'created', 'ai_analyzed', 'assigned', 'escalated',
    -- 'released', 'deleted', 'auto_released', 'auto_deleted', 'expired'

    performed_by UUID REFERENCES users(id),  -- NULL for system actions
    performed_by_type VARCHAR(20),  -- 'user', 'ai_agent', 'system', 'rule'

    details JSONB,
    /*
    Example details:
    {
      "reason": "AI confidence 97% clean",
      "rule_id": "uuid",
      "previous_status": "pending",
      "new_status": "released"
    }
    */

    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);

CREATE INDEX idx_audit_item ON quarantine_audit_log(quarantine_item_id);
CREATE INDEX idx_audit_created ON quarantine_audit_log(created_at);

API Endpoints

Tenant Admin Endpoints

GET    /api/v1/quarantine                    # List org's quarantine items
GET    /api/v1/quarantine/:id                # Get item details + AI analysis
POST   /api/v1/quarantine/:id/release        # Release file
POST   /api/v1/quarantine/:id/delete         # Delete file
POST   /api/v1/quarantine/:id/escalate       # Escalate to platform admin
POST   /api/v1/quarantine/:id/reanalyze      # Request fresh AI analysis
GET    /api/v1/quarantine/stats              # Org quarantine statistics

Platform Admin Endpoints

GET    /api/v1/admin/quarantine              # List all/escalated items
GET    /api/v1/admin/quarantine/stats        # Global statistics
POST   /api/v1/admin/quarantine/:id/release  # Release with override
POST   /api/v1/admin/quarantine/:id/delete   # Delete with override

# Rules management
GET    /api/v1/admin/quarantine/rules        # List rules
POST   /api/v1/admin/quarantine/rules        # Create rule
PUT    /api/v1/admin/quarantine/rules/:id    # Update rule
DELETE /api/v1/admin/quarantine/rules/:id    # Delete rule

# Hash lists
GET    /api/v1/admin/quarantine/hashes       # List trusted/blocked hashes
POST   /api/v1/admin/quarantine/hashes       # Add hash to list
DELETE /api/v1/admin/quarantine/hashes/:id   # Remove hash from list

# AI settings
GET    /api/v1/admin/quarantine/ai-config    # Get AI thresholds
PUT    /api/v1/admin/quarantine/ai-config    # Update AI thresholds

UI Components

Tenant Admin Quarantine View

┌─────────────────────────────────────────────────────────────────────────────┐
│  Quarantine Management                                    [Refresh] [Filter]│
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐   │
│  │ ⚠ 3 files awaiting your review    │ 12 auto-processed today        │   │
│  └─────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
│  ┌──────────────────────────────────────────────────────────────────────┐  │
│  │ □ │ File              │ Threat       │ AI Rec.    │ Uploaded  │ Action│  │
│  ├───┼───────────────────┼──────────────┼────────────┼───────────┼───────┤  │
│  │ □ │ report.pdf.exe    │ Trojan.Gen   │ 🔴 Delete  │ 2h ago    │ ••• │  │
│  │   │ ↳ AI: 98% malicious - executable masquerading as PDF           │  │
│  ├───┼───────────────────┼──────────────┼────────────┼───────────┼───────┤  │
│  │ □ │ invoice_macro.xlsm│ Suspicious   │ 🟡 Review  │ 5h ago    │ ••• │  │
│  │   │ ↳ AI: 62% suspicious - VBA macro with shell execution          │  │
│  ├───┼───────────────────┼──────────────┼────────────┼───────────┼───────┤  │
│  │ □ │ backup.zip        │ Suspicious   │ 🟢 Release │ 1d ago    │ ••• │  │
│  │   │ ↳ AI: 89% clean - false positive, contains .exe installers     │  │
│  └──────────────────────────────────────────────────────────────────────┘  │
│                                                                             │
│  [Bulk: Release Selected] [Bulk: Delete Selected] [Bulk: Escalate]         │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────────────┐
│  Quarantine Review: report.pdf.exe                                    [X]  │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  FILE INFO                           AI ANALYSIS                            │
│  ─────────────────────────────       ─────────────────────────────          │
│  Name: report.pdf.exe                Confidence:                            │
│  Size: 2.4 MB                        ├── Clean: 2%                          │
│  Type: PE Executable                 ├── Suspicious: 0%                     │
│  SHA256: 8a3f2b...                   └── Malicious: 98%                     │
│  Uploaded by: [email protected]                                                 │
│  Context: Audit Evidence             Recommendation: 🔴 DELETE              │
│                                                                             │
│  SCANNER RESULTS                     FINDINGS                               │
│  ─────────────────────────────       ─────────────────────────────          │
│  ClamAV: Trojan.GenericKD.46542      ⚠ Type mismatch: .pdf.exe             │
│  OTX: 3 threat indicators            ⚠ Known malware signature              │
│                                      ⚠ High entropy (packed/encrypted)      │
│                                      ⚠ Network callback detected            │
│                                                                             │
│  AUDIT TRAIL                                                                │
│  ─────────────────────────────                                              │
│  • 2h ago - Uploaded by [email protected]                                       │
│  • 2h ago - ClamAV flagged: Trojan.GenericKD.46542                          │
│  • 2h ago - AI analysis: 98% malicious                                      │
│                                                                             │
│  ┌─────────────────────────────────────────────────────────────────────┐   │
│  │ Resolution reason (required):                                        │   │
│  │ ┌─────────────────────────────────────────────────────────────────┐ │   │
│  │ │                                                                 │ │   │
│  │ └─────────────────────────────────────────────────────────────────┘ │   │
│  │                                                                      │   │
│  │ □ Block this file hash (prevent future uploads)                     │   │
│  │ □ Trust this file hash (auto-release future uploads)                │   │
│  └─────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
│  [Cancel]           [Escalate to Platform Admin]    [Delete] [Release]     │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

Platform Admin Dashboard

┌─────────────────────────────────────────────────────────────────────────────┐
│  Platform Quarantine Overview                              [Settings] [Rules]│
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  TODAY'S STATS                                                              │
│  ┌────────────┐ ┌────────────┐ ┌────────────┐ ┌────────────┐               │
│  │    127     │ │     98     │ │     14     │ │     15     │               │
│  │  Scanned   │ │Auto-Release│ │Auto-Delete │ │For Review  │               │
│  └────────────┘ └────────────┘ └────────────┘ └────────────┘               │
│                                                                             │
│  AI PERFORMANCE (Last 7 days)                                               │
│  ─────────────────────────────                                              │
│  Auto-release accuracy: 99.2% (1 false negative caught by tenant admin)    │
│  Auto-delete accuracy: 100% (0 appeals)                                     │
│  Human review rate: 11.8%                                                   │
│                                                                             │
│  ESCALATED ITEMS (3)                                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐  │
│  │ Org        │ File              │ Escalated By  │ Reason       │ Action│  │
│  ├────────────┼───────────────────┼───────────────┼──────────────┼───────┤  │
│  │ Acme Corp  │ deploy.sh         │ admin@acme    │ Unsure       │ ••• │  │
│  │ TechStart  │ update_v2.exe     │ cto@techstart │ Need verify  │ ••• │  │
│  │ HealthCo   │ patient_export.py │ auto-escalate │ PHI detected │ ••• │  │
│  └──────────────────────────────────────────────────────────────────────┘  │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

Implementation Phases

Phase 1: Foundation (MVP)

[ ] Database schema migration
[ ] Basic quarantine API endpoints
[ ] Tenant admin quarantine list view
[ ] Manual release/delete functionality
[ ] Audit logging

Phase 2: AI Integration

[ ] AI analysis agent implementation
[ ] Analysis queue processing (background job)
[ ] AI results display in UI
[ ] Recommendation badges

Phase 3: Automation

[ ] Auto-action rules engine
[ ] Hash trust/block lists
[ ] Auto-release for high-confidence clean
[ ] Auto-delete for confirmed malware
[ ] Expiration handling

Phase 4: Platform Admin

[ ] Global dashboard
[ ] Escalation workflow
[ ] Rules management UI
[ ] AI threshold configuration
[ ] Cross-tenant visibility

Phase 5: Advanced

[ ] Bulk operations
[ ] Advanced filtering
[ ] Export/reporting
[ ] Integration with SIEM
[ ] Security team tier (optional)

Configuration Options

yaml

quarantine:
  # AI thresholds
  ai:
    auto_release_threshold: 95    # Clean confidence >= this = auto-release
    auto_delete_threshold: 95     # Malicious confidence >= this = auto-delete
    escalation_severity: critical # Auto-escalate at this severity

  # Expiration
  expiration:
    default_days: 30              # Days before auto-delete
    warn_before_days: 7           # Notify before expiration

  # Notifications
  notifications:
    notify_uploader_on_quarantine: true
    notify_uploader_on_delete: true
    notify_admin_on_escalation: true
    notify_admin_daily_summary: true

  # File handling
  files:
    max_size_mb: 100              # Max file size to analyze
    allowed_analysis_types:       # File types AI can analyze
      - text/*
      - application/javascript
      - application/x-python
      - application/x-sh
      - application/json
      - application/xml

Security Considerations

Quarantine Storage
- Files stored in isolated storage (separate bucket/volume)
- No execution permissions on quarantine storage
- Files renamed to prevent accidental execution
Access Control
- Tenant admins can only see their organization's files
- All actions require authentication + authorization
- Audit log is immutable
AI Safety
- AI agent runs in sandboxed environment
- No execution of quarantined files
- Analysis based on static inspection only
Data Protection
- Quarantined files encrypted at rest
- Access logged for compliance
- Automatic purge after retention period

Metrics & Monitoring

Key Metrics

Quarantine volume (files/day)
Auto-action rate (% handled without human)
Mean time to resolution
False positive rate (released then re-flagged)
False negative rate (clean then reported)
AI accuracy by file type
Escalation rate

Alerts

Quarantine queue exceeds threshold
AI analysis backlog growing
Unusual spike in flagged files
Same file flagged across multiple tenants (potential campaign)

Tiered Quarantine Management System Design ​

Overview ​

Architecture ​

Responsibility Tiers ​

Tier 1: Automated Actions (No Human Intervention) ​

Tier 2: Tenant Admin Review ​

Tier 3: Platform Admin ​

Tier 4: Security Team (Optional) ​

AI Agent Design ​

Agent Capabilities ​

Analysis Output Schema ​

AI Decision Matrix ​

Database Schema ​

quarantine_items ​

quarantine_hash_list ​

quarantine_rules ​

quarantine_audit_log ​

API Endpoints ​

Tenant Admin Endpoints ​

Platform Admin Endpoints ​

UI Components ​

Tenant Admin Quarantine View ​

File Detail Modal ​

Platform Admin Dashboard ​

Implementation Phases ​

Phase 1: Foundation (MVP) ​

Phase 2: AI Integration ​

Phase 3: Automation ​

Phase 4: Platform Admin ​

Phase 5: Advanced ​

Configuration Options ​

Security Considerations ​

Metrics & Monitoring ​

Key Metrics ​

Alerts ​