Security playbook · AI Employee: Sig

Incident Response Orchestration

MTTR falls quarter-over-quarter

Install this playbookBack to marketplace
The problem

The first 30 minutes of an incident determine the outcome; those 30 minutes are also when the response is most chaotic. Analysts are IMing each other for context, someone else is trying to page the on-call, a third person is manually gathering system state before anyone has decided what the incident is. By the time IR has coordinated who does what, the attacker has been through the environment for hours. The playbook exists in Confluence; nobody reads it during the incident.

At a glance
Trigger
Monitor event + chat
Approvals
IC approval on external comms
What it does
Writes to your systems
Systems
SIEM · PagerDuty · Slack · Runbook KB
How it feels in production

An hour-by-hour walkthrough.

02:47. CrowdStrike fires a high-severity alert on a workstation. Sig picks it up, opens an incident channel `#sec-inc-2026-09-07-01` in Slack, and starts orchestrating. Immediate parallel actions (30 seconds in): - Page the security on-call via PagerDuty with the alert summary - Pull relevant context: user, device, recent logins, running processes, network flows, EDR full detection detail - Pre-isolate the device pending analyst approval (contain-first posture per playbook config) - Pull the last 48 hours of the affected user's identity events (Okta, GitHub, AWS, key applications) By the time the on-call analyst opens their laptop (3 minutes in), the incident channel is populated with: - Alert detail + CrowdStrike detection graph - Affected user's normal-behaviour baseline + current-behaviour deltas - Recent activity across identity + code + infra planes - Isolation status of the device - Draft incident timeline (already 3 minutes long) - Suggested containment actions with one-click approve Analyst reads for 90 seconds. Approves the containment: kill process, disable user session, force password rotation, revoke active tokens. Sig executes and updates the timeline in real time. Every action is logged; every stakeholder is briefed as their role becomes relevant (legal at 15 minutes for potential incident notification, exec at 30 minutes for known-severity classification). Post-incident: Sig assembles the timeline + evidence bundle + IOC list for the after-action, and files the closure record.
How it works

Step by step.

  1. 01

    Open the incident + spin up the channel

    On high-severity alert, open incident channel with the alert detail. Page on-call. Set incident status. Naming convention consistent across incidents for easy retrieval.

    PagerDuty · Slack · Teams · Incident naming convention
  2. 02

    Gather context in parallel

    Every relevant plane at once: identity, endpoint, network, code, infra, application logs. Enrichment finishes before the analyst opens their laptop.

    Okta · CrowdStrike · SentinelOne · SIEM · Cloud logs · Application logs
  3. 03

    Pre-contain per playbook config

    Playbook-configured pre-containment actions (isolate device, disable session, revoke tokens) execute immediately with pre-approved authority. Analyst overrides on arrival if wrong; time is more valuable than a rollback.

    EDR isolation · Okta suspend · Token revocation · IAM disable
  4. 04

    Orchestrate the analyst-led response

    Every containment / eradication / recovery action surfaced with one-click approve. Executes on approval; verifies success; updates the timeline. Every stakeholder briefed as their role becomes relevant.

    Slack · Teams · Approval flow · Stakeholder registry
  5. 05

    Post-incident evidence + after-action

    Timeline, evidence bundle, IOC list, affected-entity list, containment actions, timeline of stakeholder briefings. Post-incident review draft with root cause hypothesis + remediation recommendations.

    Evidence store · Confluence · Incident tracker
Systems and wiring

What you connect to make this run.

CrowdStrike · SentinelOne · Microsoft Defender

read+write

EDR detection detail, device state, process graphs. Isolation write for containment. Read for post-incident evidence bundle. Correlation IDs preserved across the response.

Okta · Google Workspace · Microsoft Entra

read+write

Identity plane state + control. User activity history, active sessions, application access. Write: session revoke, account disable, token revoke, MFA reset.

SIEM · Data lake

read+write

Correlation across systems. Read for context assembly + timeline; write incident annotations + IOC extractions for future correlation.

PagerDuty · Slack · Teams · Confluence · Jira

read+write

Paging, war-room channel, live timeline, evidence storage, post-incident tracking. Full lifecycle from page to closure in one connected surface.

What changes

Before and after, honestly.

Time from alert to first analyst action
Before
15-45 minutes
After
Under 4 minutes
Mean time to containment
Before
45 minutes to 4 hours
After
8-25 minutes
Post-incident evidence completeness
Before
40-70% (manual gathering after)
After
95%+ (assembled live)
Incidents where playbook was followed
Before
30-50%
After
95%+ (playbook is the mechanism, not a document)
Related

Playbooks that pair with this one.

Security

Security Alert Triage & Context

Same triage engine promoted to incident on high severity.

Security

Compromised Credential Response

Specific incident-type playbook orchestrated by this generic frame.

Security

Anomalous Login

Common upstream trigger; anomalous-login promotes to incident on high fusion score.

Frequently asked

Answers about this playbook.

Isn't pre-containment risky if the alert is a false positive?

Pre-containment actions are configurable per playbook: high-severity + high-confidence detections isolate; medium severity gathers context only. False-positive rollback is one action (unisolate, re-enable session). Time cost of false-positive containment is minutes; time cost of not containing a real incident is hours.

How does it handle multi-system incidents (endpoint + cloud + application)?

Correlation across planes. Sig maintains one incident with per-plane sub-timelines. Containment actions across planes coordinate (isolate device + revoke cloud credentials + expire application session together).

What about incidents that need external communication (customer, regulator)?

Communication playbook triggers per severity + data-class. Draft notifications to affected parties, legal + comms review, tracked send. Regulator notifications on the regulator's clock (72 hours GDPR, etc.); Sig calendarises the deadline.

How does this coordinate with our incident-command process?

Sig runs the operational orchestration; incident commander runs the strategic decisions. Sig provides the situation report; IC directs actions. Roles complementary, not overlapping.

What if the on-call analyst is unreachable?

Escalation ladder: backup on-call at 5 minutes, security manager at 10, CISO at 20. Pre-containment continues on playbook authority; analyst-required actions wait until human is engaged.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore Security playbooks