Before
SOC analysts had to open the security console, determine the appropriate remediation action, start remote sessions, execute commands, wait for completion, and verify the result manually. Indicator-related actions also required separate navigation and updates, creating additional handoffs between detection and response.
How it works
- Receive the requested host and remediation action, then route the request to containment, remote command execution, or indicator creation.
- Apply containment directly or open a remote response session to execute the required administrator command; remote actions are monitored until they complete.
- Store the execution details and return a timestamped status result for the completed remediation.
Workflow details
- Request intake: The workflow starts when a remediation request provides a target host and an action. The action determines which remediation path should be followed.
- Action routing: The flow evaluates the requested action and can send a host to containment, initiate remote command remediation for actions such as removal or termination, or follow the indicator-creation branch.
- Host remediation: Containment is submitted directly for the specified host. Remote remediation opens a real-time response session, runs an administrator command, and preserves the session while the operation is processed.
- Completion monitoring: Remote command status is checked repeatedly until the operation is marked complete. The workflow stores status, timing, completion state, and command output during this process.
- Result delivery: After the selected path finishes, the workflow closes successfully with a result containing the remediation status and completion time, providing a consistent handoff for the system or analyst that initiated the request.
What changed
The requester now supplies the host and action once, while the workflow selects and executes the corresponding remediation path automatically. Remote actions are polled until completion and handed back with a status and timestamp, removing the need for analysts to navigate between screens and verify each step manually.
Work removed
Manually opening the security console, selecting the remediation path, starting remote sessions, entering commands, waiting for completion, checking command status and output, confirming the result, and updating indicators.
Expected outcome
The workflow is designed to remove an estimated 5–10 manual actions per remediation event while providing a consistent completion status for each request.
