Security Operations
Automation Rules & Playbooks
๐Ÿ”Ž
โ“

Automation Rules

WHEN conditions match, THEN actions execute - always respecting safety modes, exclusions, dry-run and approvals.
Critical Credential Theft Response
Disabled
Respond to critical credential-access incidents with hunting, evidence collection, notification and approval-based isolation.
mode: approval required priority: 10 runs: 0
WHEN
severity eq Critical
mitre_techniques in ['T1003', 'T1003.001', 'T1003.008', 'T1558']
risk_score gte 85
THEN
โ†’ run_hunting_queries
โ†’ collect_evidence
โ†’ notify_teams
โ†’ create_sentinel_incident
โ†’ isolate_device
Command & Control Response
Enabled
Respond to command-and-control activity with hunting, enrichment and approval-based indicator blocking.
mode: approval required priority: 15 runs: 0
WHEN
mitre_techniques in ['T1071', 'T1071.001', 'T1102', 'T1571', 'T1572', 'T1568', 'T1568.002']
risk_score gte 75
THEN
โ†’ run_hunting_queries
โ†’ collect_evidence
โ†’ enrich_threat
โ†’ notify_teams
โ†’ block_indicator
Ransomware Impact Response
Enabled
Escalate ransomware impact incidents and request approval for isolation.
mode: approval required priority: 20 runs: 1356
WHEN
mitre_techniques in ['T1486', 'T1490']
severity in ['Critical', 'High']
THEN
โ†’ notify_soc
โ†’ collect_investigation_package
โ†’ block_indicator
โ†’ isolate_device
Persistence & Defense Evasion Response
Enabled
Investigate persistence and defense-evasion techniques and collect forensic evidence.
mode: approval required priority: 25 runs: 1358
WHEN
mitre_techniques in ['T1055', 'T1547', 'T1547.001', 'T1053.005', 'T1484', 'T1136', 'T1505.003']
THEN
โ†’ investigate
โ†’ collect_investigation_package
โ†’ run_hunting_queries
โ†’ notify_soc
โ†’ block_indicator
Data Exfiltration Response
Enabled
Hunt for data-exfiltration indicators and request approval for containment.
mode: approval required priority: 30 runs: 0
WHEN
mitre_techniques in ['T1041', 'T1048', 'T1567', 'T1567.002', 'T1030']
THEN
โ†’ run_hunting_queries
โ†’ collect_evidence
โ†’ notify_teams
โ†’ escalate_incident
โ†’ block_indicator
Critical Vulnerability Remediation
Enabled
Create a ticket, notify SOC and request approval to remediate critical vulnerabilities (CVSS >= 9).
mode: approval required priority: 35 runs: 5418
WHEN
severity eq Critical
cvss gte 9.0
THEN
โ†’ create_ticket
โ†’ notify_soc
โ†’ create_remediation_task
Lateral Movement Investigation
Enabled
Investigate lateral movement indicators with hunting queries.
mode: recommend priority: 40 runs: 0
WHEN
mitre_techniques in ['T1021', 'T1021.002', 'T1550.002', 'T1570']
THEN
โ†’ run_hunting_queries
โ†’ collect_evidence
โ†’ notify_teams
Exploitable Vulnerability Alert
Enabled
Alert SOC when a vulnerability with a known exploit is present (dry-run recommendation).
mode: recommend priority: 45 runs: 0
WHEN
exploit_available eq True
severity in ['Critical', 'High']
THEN
โ†’ notify_teams
โ†’ create_ticket
โ†’ create_remediation_task
High Risk Device SOC Alert
Enabled
Notify SOC for high-risk incidents with medium severity or above.
mode: automatic priority: 50 runs: 2711
WHEN
severity in ['Critical', 'High', 'Medium']
device_risk eq High
THEN
โ†’ notify_teams
โ†’ update_incident