Workflows
Automation an analyst can read, simulate, and approve
Workflows run inside your installation, beside the case, not in a separate tool. Each step is visible on the canvas, and an approval step can hold the run before it acts.
A run, step by step
Contain a host after a critical EDR alert
This is one of the built-in templates. It opens a case, looks up the device, waits for approval, and only then contains the host in CrowdStrike. It needs the CrowdStrike Falcon connector and a network path to the Falcon API. Step through it with the controls.
Folders
- Response4
- Alert triage3
- SLA3
- Detection1
- ITSM3
Step 6 of 6: Notify case owner. Run complete.
Simulated run of the built-in template. No connector was called.
Library
A library you can find things in
Workflows live in folders you name and color. Start from a template, review what it will change, and keep your edits as a new version.
- Folders with colors, like the case labels
- Templates you review before you use them
- Versions you can compare
Editor
Every step on the canvas
A trigger with conditions, in-app actions, connector actions, approvals, and an end. Simulate the workflow against a sample before it runs, and read the path it would take.
- Approval steps that hold the run until someone approves
- Connector actions on governed credentials
- Simulation before activation
AI steps
A step the run can show you
An AI step can analyze an alert or a case, suggest techniques, recommend tasks, or draft the case description, using the model your installation points at. What it suggests waits for an analyst.
The built-in After-Hours Alert Brief does one thing: outside business hours, it runs AI alert analysis on new high and critical alerts, so the on-call analyst starts from a verdict that quotes the alert. Containment is a different template, and it still waits on an approval step.
- Analyze alert, determine TTPs, analyze case, recommend tasks, or draft the description
- Conditions on the step decide which alerts it runs on
- The organization's AI data policy applies to every AI step
Templates
Fourteen templates in the product today
Each one installs as an ordinary workflow you can open, change, and simulate.
Contain a host after a critical EDR alert
ResponseOpens a case, looks up the device, waits for approval, then contains the host in CrowdStrike.
Includes a required approval step
Block an IP from a GuardDuty finding and record it in ServiceNow
ResponseOpens a case, waits for approval, blocks the IP on the Palo Alto firewall, then creates a ServiceNow incident documenting the block.
Includes a required approval step
Enrich a phishing alert with MISP and open a Jira issue
ResponseSearches MISP for the reported indicator, opens a case with a review task, then creates a Jira issue in the connected project.
Phishing Alert Workflow
ResponseCreates a case for a phishing alert, sets the case type, enriches the alert, adds a mandatory task, and records the MITRE ATT&CK technique.
Auto-Route Critical Alerts
Alert triageRoutes critical alerts to the SOC Tier 2 team with an SLA.
Auto-Create Case from High Severity Alert
Alert triageCreates a case when a high or critical alert arrives.
After-Hours Alert Brief
Alert triageOutside business hours, runs AI analysis on new high and critical alerts so the on-call analyst starts from a verdict that quotes the alert.
SLA Warning Notification
SLANotifies the team when a case reaches 25% of its SLA remaining.
SLA Critical Escalation
SLAEscalates a case when 10% of its SLA remains.
SLA Breach Escalation
SLAEscalates a case when its SLA is breached.
Recurring Incident Detection
DetectionCorrelates recurring incidents to identify campaigns.
Auto-Create ServiceNow Ticket for Remediation Tasks
ITSMCreates a ServiceNow ticket when a remediation task is added to a high or critical case.
Auto-Create Jira Issue for IT Tasks
ITSMCreates a Jira issue when a task is assigned to an IT team.
Create Change Request for Critical Remediation
ITSMCreates a ServiceNow change request for critical remediation tasks that need approval in ServiceNow.
Templates that call a connector need that connector configured first, and a network path from your installation to that product.
Watch a workflow wait for approval
On a live call, we run a template on our demo installation and show where the approval step holds the run.