Every rule ships the playbook for the thing it just caught.
The alert carries its own playbook, ordered, with the reason each step comes when it does.
Detect, guided response
The alert fires at 2am and the person on call has never seen this rule before.
How it works
Every rule ships a response block: the triage questions to ask, and the criteria for escalating
Where the misconfiguration can be fixed with a script, the rule carries the PowerShell to fix it
Closing an alert captures a classification and a resolution action, leaving a record of what was done
Ask the specialist that owns this work.
Ask in your own words. The Response Agent runs as you, and any action it can take ships off until an admin turns it on.
Response Agent
Containment steps you pick from: revoke sessions, disable sign-in, force MFA re-registration.
- You asked: Contain this account until we know more
Nuvio answered: Revoking sessions and forcing MFA re-registration would both fit here, in that order. The buttons are on the alert. Until you switch those actions on, I do not press them.
Switched offSession revoke is switched off for this connection
Every write-back task ships off. Turn it on in the connector settings and a person runs it from the console.