{{ page.title }}

{{ it.mark }} {{ it.text }}

{{ h }}
{{ cell.t }}

{{ b.text }}

{{ b.text }}

{{ cd.title }} {{ cd.desc }}

{{ stp.n }}

{{ stp.title }} {{ stp.desc }}

WORKFLOW RUN · ALERT-TRIAGERUNNING

Grouped 14 related alerts into one case0.4s

Enriched with asset owner, user risk and threat intel1.2s

Guardrails checked: host not protected, within rate limit0.1s

Proposed: isolate host FIN-WS-0142Awaiting approval · on-call J. Okafor—

ApproveRejectAsk why

APPROVAL NEEDED · P2 · CASE-20417WAITING 2M

Isolate host FIN-WS-0142 Encoded PowerShell spawned vssadmin to delete shadow copies. Matches ransomware precursor pattern T1490.

IMPACTUser loses network access; EDR channel stays open

ROLLBACKrelease_host, one click

GUARDRAILSNot protected · within rate limit

REQUESTED BYIncident response workflow

ApproveRejectAsk why

TYPICAL TIMELINE

W1W2W3W4W5W6W7W8W9W10→

Assess

Build

Run side by side

Improve

Faded segments show the range. The retainer starts once the first workflows are live.

SOURCES

EndpointsCloud accountsIdentitySaaS and email

VISOT SIEM

CollectNormaliseDetectCorrelate

WORKFLOWS

TriageRespondPolicy engine

OUTCOMES

Approver in Slack or TeamsYour toolsEvidence store

01Detection02Triage03Escalate04Propose05Approve06Execute07Case record