Use case · SOC and incident response
Detonate samples, train analysts and run SOC agents on machines that cannot reach out.
Updated 2026-10-31
kosa8 gives security operations teams a malware detonation lab on their own hardware: kosa8 lab detonate runs a Linux sample in a microVM whose only network is a simulated internet on the host, captures the traffic, snapshots and seals the infected machine, and writes a signed report anyone can verify offline. The same sandboxes contain AI agents doing triage, behind an allow-listed network and a hash-chained audit log.
01The problem: hostile input, everywhere
An analyst detonating a sample needs a machine that looks connected, so the sample behaves as it would on a real network, an assurance that nothing it sends reaches anything real, and a record someone else can check. That is often a simulator such as INetSim or FakeNet-NG on a second VM, a span port and a spreadsheet. Training ranges take hours to rebuild between classes.
AI agents in the SOC add a newer risk: alerts, emails and samples are attacker-controlled input, so an agent that reads them can be steered. It should not be able to turn the SOC's own access and keys against the network it defends.
02A simulated internet that forwards nothing
--egress fakenet answers every DNS name with a sink address and terminates TCP on the host, where HTTP, TLS (with a lab CA) and SMTP responders reply and record what the sample said. Other UDP is recorded and dropped. Add a packet capture from the first frame.
03One command per detonation, one signed report
kosa8 lab detonate boots a fresh fakenet sandbox, checks the host is enforcing fakenet, runs the sample, snapshots the machine with the sample still in it, and records processes, changed files and every network interaction. The report package is signed; lab verify checks it and lab diff compares two runs. Only Linux samples run, because the guest is Linux.
04Branch the infected machine
The infected state lives on in a sealed snapshot. Restore it, or fork a running sandbox into several live copies with process state intact, and try a different step in each from an identical starting point.
05Chain of custody for what you captured
Sealing a snapshot signs it with a stated reason, and restores verify the seal first. Evidence packages carry the audit entries, seals and signed manifest, and verify with nothing but the package.
06Training ranges that reset in seconds
A scenario file names the image, setup and objectives. range up prepares it once and gives each trainee a live clone on an isolated network; range reset puts one trainee back without touching anyone else, and scores go to the audit log.
07Triage agents that cannot be turned around
Run triage and hunting agents in sandboxes that reach only the hosts they need, with model keys added by the host-side broker rather than stored in the VM. Ship the audit log to your SIEM as CEF.
08How to start
Use a dedicated, patched analysis host, as with any malware lab.
Install kosa8 on an Apple silicon Mac or x86-64 Linux, then start the daemon.
Detonate a known test sample first and verify the report before you run anything live.
09Questions
Can malware in a kosa8 detonation reach the real internet?
The sandbox's only network is fakenet, enforced on the host: DNS gets sink addresses, TCP is answered by responders on the host, and nothing is forwarded. The detonation checks that the host is enforcing fakenet before the sample runs. As with any lab, keep the host itself patched and dedicated.
Which samples can kosa8 run?
Linux samples only, because the guest is Linux. A sample runs directly as an ELF or a script with a #! line, or through a command line you give with --cmd.
Can a sample tell it is in a sandbox?
Possibly. It runs in a virtual machine on a simulated network, and kosa8's design notes list what a sample can still detect. Treat a quiet run as inconclusive, not as clean.
How do I share a result with another team?
Send the report package. kosa8 lab verify checks its signature and, given the sample, its digest, offline, and kosa8 lab diff compares two reports.
10Further reading
- How do I run untrusted LLM-generated code safely?
- How do I try several AI agent approaches in parallel?
- How do I restrict an AI agent's network access to an allow-list?
- Docker containers vs microVMs: which isolates an AI agent better?
- AI agents in SOC and incident response: risks, controls and fit
- AI agent security checklist for 2026
11Sources
12Get kosa8
Install kosa8 on an analysis host and run a first detonation. Team and Enterprise terms are on the pricing page.