Before
An analyst worked through endpoint and directory tools to apply each containment action individually. The analyst then copied the outcomes and action details back into the incident record, creating a manual handoff between remediation and documentation.
How it works
- Receive the incident and selected containment plan, then map each action to the appropriate endpoint or identity response path.
- Process each action sequentially, execute supported isolation, scanning, or identity-disablement actions, and skip unknown action types.
- Compile the results and post a remediation record to the incident before returning a completed status.
Workflow details
- Plan intake: The workflow receives a Sentinel incident, a selected list of response actions, and the source of the decision, then associates each action with the configured endpoint or identity response path.
- Action routing: Actions are processed one at a time. Endpoint isolation and scanning are routed according to the configured endpoint security provider, while identity disablement sends a request to deactivate the account and revoke active cloud identity sessions.
- Validation and handling: Supported actions are executed through their matching branch, while unknown action types are explicitly skipped rather than executed. The workflow tracks the results returned by each branch.
- Incident documentation: After processing the plan, the workflow creates a remediation record containing the incident context, decision source, action summary, execution count, and returned results, then posts it to the Sentinel incident. The configured demonstration uses synthetic responses for the endpoint and incident-recording steps.
What changed
Containment actions are routed and processed automatically one at a time, with supported actions, skipped action types, and returned results assembled into a remediation comment. The human-selected plan and decision source remain part of the documented handoff.
Work removed
Manually reviewing and routing each containment action, switching between endpoint and identity tools, copying individual action outcomes, and updating the incident record with the remediation summary.
Expected outcome
The workflow removes at least one manual result-copying handoff for each executed action and leaves the incident with a consistent remediation record; the exact time saved depends on the plan size and response paths.
