Docs menu

Fix it safely

Select Fire: simulate a change, run it with the autonomy you allow, and undo it.

10 guides

Select Fire

Select FireSimulate the blast radius of removing a group membership, ACE or permission edge, then run it with undo or get a script. Includes the safety score.
Why Select Fire recommends a changeRead why Select Fire recommends each change and how far each automated remediation can run on its own, from Safe Mode to Full-Auto, with blast radius.
Remediation action catalogEvery auto-remediation action Select Fire runs in Active Directory and Entra ID, with userAccountControl flags, the deny list, undo classes and the audit trail.

Semi-AutoSemi-Auto automated remediation: authorize each Select Fire action, run it through the Identity Bridge, verify it in the directory, and undo it if needed.
Full-AutoFull-Auto is GraphnAI's automated remediation (auto-remediation) mode. Arm it and review the deny list, shadow mode report and rollback watches.
Undo a changeCheck whether an auto-remediation action is reversible before it runs, then revert it with Undo from saved state, including container ACE removals.
Closed-Loop RollbackClosed-Loop Rollback watches hosts after a Full-Auto action and rolls it back or escalates it when failed logons or failed services exceed their baseline.

Fix Kerberos delegation findingsFix RBCD, unconstrained delegation, protocol transition and Shadow Credentials findings, and review the Kerberoasting, Timeroasting and BadSuccessor checks.Active Directory
Remove an ACE or DCSync rightRemove one ACE or a DCSync right from an Active Directory object with Select Fire. Simulate the blast radius first, then undo from a saved state.Active Directory
Rotate KRBTGT and break-glass accountsRotate the KRBTGT password twice (Golden Ticket), reset the built-in Administrator, and clear cross-tier credential exposure when GraphnAI has no automated fix.Active Directory