Automations
One-click orchestration for the sequences nobody should be running by hand at three in the morning. Every step is readable before it runs, and the log records which steps changed real state inside Aegis and which only simulated an external system.
// Detection
Tune out a false positive
DetectionClose the loop on activity confirmed benign: suppress the pattern so the same finding does not return tomorrow, with the justification recorded.
// Endpoint
Isolate host
DestructiveEndpointNetwork quarantine for a compromised endpoint. The host stays powered on because memory is evidence.
// Identity
Emergency account lockout
DestructiveIdentityImmediate containment for a credential believed to be in someone else’s hands. Faster and narrower than offboarding: stop the access now, investigate after.
Rotate service credentials
IdentityReplace a service account’s secrets after exposure, in the order that avoids an outage: issue new, deploy, then revoke old.
User offboarding
DestructiveIdentityFull departure workflow for a leaver. Runs the whole sequence in order so nothing is forgotten at the point people are least likely to be careful: the last day.
// Messaging
Purge phishing campaign
DestructiveMessagingRemove a malicious message from every mailbox that received it and block the infrastructure behind it.
// Network
Block address at the perimeter
NetworkPush a hostile address to the edge and into the intel feed, so future telemetry involving it is flagged retroactively as well as blocked.
// Vulnerability
Remediate vulnerability
VulnerabilityPatch a known weakness on an inventoried asset and confirm the fix landed. Verification is a step because a patch that did not apply is worse than one never attempted.
Execution history
Each run, with the steps it completed and what they actually changed.
Nothing has run yet
Execute an automation above and the full step log appears here.