Add shadow security finding inbox

configs/containment-finding.example.json

@@ -0,0 +1,21 @@
+{
+  "host": "HOST-EXAMPLE",
+  "host_role": "workstation",
+  "state": "suspected_infected",
+  "confidence": "high",
+  "signals": [
+    {
+      "source": "hayabusa",
+      "rule_id": "sigma-placeholder-critical",
+      "confidence": "critical"
+    },
+    {
+      "source": "velociraptor",
+      "rule_id": "Windows.Hayabusa.Monitoring",
+      "confidence": "high"
+    }
+  ],
+  "recommended_action": "windows_firewall_quarantine",
+  "management_channel_checked": true,
+  "manual_operator_flag": false
+}

configs/containment-policy.example.json

@@ -0,0 +1,17 @@
+{
+  "enabled": false,
+  "mode": "shadow",
+  "default_ttl_minutes": 60,
+  "require_admin_channel_check": true,
+  "allow_auto_for_servers": false,
+  "allowed_actions": [
+    "windows_firewall_quarantine",
+    "pfsense_host_block"
+  ],
+  "management_allowlist": [
+    "aw_server",
+    "velociraptor_server",
+    "admin_jump_host"
+  ],
+  "minimum_high_signals_for_auto": 2
+}

configs/security/security-finding.example.json

@@ -0,0 +1,21 @@
+{
+  "ts": "2026-06-25T10:00:00Z",
+  "host": "HOST-EXAMPLE",
+  "user": "user-example",
+  "ip": "10.10.20.42",
+  "department": "demo",
+  "state": "suspected_infected",
+  "severity": "critical",
+  "confidence": "high",
+  "score": 95,
+  "source": "hayabusa",
+  "rule_id": "demo-sigma-critical",
+  "rule_title": "Demo high-confidence suspicious workstation",
+  "summary": "Demo finding for Security Finding Inbox validation.",
+  "recommended_action": "windows_firewall_quarantine",
+  "management_channel_checked": true,
+  "evidence_ref": "demo://hayabusa/HOST-EXAMPLE/demo-sigma-critical",
+  "metadata": {
+    "sample": "true"
+  }
+}

configs/windows-firewall-containment-request.example.json

@@ -0,0 +1,18 @@
+{
+  "target_host": "HOST-EXAMPLE",
+  "plan_id": "rollback-host-example-001",
+  "ttl_minutes": 60,
+  "reason": "High-confidence Hayabusa and Velociraptor containment drill",
+  "management_allowlist": [
+    "10.10.10.10",
+    "10.10.10.11",
+    "10.10.10.12"
+  ],
+  "blocked_remote_addresses": [
+    "10.10.20.0/24",
+    "10.10.30.0/24"
+  ],
+  "profiles": [
+    "Domain"
+  ]
+}