Before
An analyst gathered the finding, asset and owner details, assessed whether containment was safe, and assembled a remediation plan across several security consoles. The analyst then coordinated approval, applied endpoint, identity, firewall, or indicator actions, and manually copied the results into the incident ticket and SOC channel.
How it works
- Receive the hunt result and automatically evaluate containment eligibility using the asset, verdict, criticality, endpoint, and evidence context.
- Generate a constrained remediation proposal, validate that each action has a supported target, and present the options to the SOC for approval or escalation.
- Execute the selected supported actions independently, update the incident record, publish the response summary, and return action statuses and failures.
Workflow details
- Receive and qualify the finding: The flow receives a normalized hunt result, asset and owner qualification, and triage data from a calling SOC workflow. It evaluates the asset type, criticality, verdict, endpoint identifier, existing containment status, and supporting evidence such as an executed hash or high-confidence command-and-control signal.
- Apply eligible initial containment: When the containment rules are satisfied, the workflow sends the configured endpoint isolation request and records whether automatic containment was completed. Findings that do not meet the rules continue to analyst review without automatic isolation.
- Prepare and validate the plan: An AI analyst proposes remediation actions from a closed catalogue, while the workflow supplies targets and removes actions that are unsupported or lack an eligible target. The resulting plan is presented in a SOC Teams channel with options to apply the plan, block all supported indicators, mark the finding as a false positive, or escalate to tier three.
- Execute the analyst decision: The selected path can isolate or release the endpoint, tag IPs for firewall blocking, add indicators to an external detection list or endpoint platform, revoke the owner’s sessions, or request escalation. Actions run independently so a failure does not prevent subsequent supported actions from being attempted.
- Document and communicate the outcome: The workflow summarizes automatic containment, the analyst decision, each action’s status, failures, and any escalation. It updates the incident ticket and posts the response summary to the SOC channel, then returns the decision, ticket number, action results, and failure count.
What changed
Containment eligibility, action targeting, and plan validation now happen automatically before the SOC decision. Analysts receive a prepared decision card, retain control over the response choice, and receive a documented outcome in the ticket and SOC channel without manually coordinating each supported action.
Work removed
Reassembling hunt, asset, owner, and triage details; checking containment rules manually; preparing and validating the remediation plan; coordinating endpoint, identity, firewall, and indicator actions; copying action results into the ticket; and posting the response summary to the SOC channel.
Expected outcome
A conservative expected outcome is the removal of at least three recurring manual handoffs per eligible incident, while preserving analyst approval for follow-up actions and providing a complete response record.
