Automated Response

Actions Taken (24h)

342

19% vs yesterday

Auto-Remediated

81.4%

4.2% vs yesterday

Pending Approval

2 new in last hour

Avg. Response Time

1.8s

12% faster vs yesterday

Active Playbooks

1 new this week

Integrations Connected

4 / 4

All systems nominal

Stop Agent
Auto-Execute
Immediately halt an agent's current execution loop and reject new instructions.
Pause Execution
Auto-Execute
Suspend an in-flight agent run pending analyst review, preserving state for resume.
Kill Session
Requires Approval
Forcibly terminate a compromised session and revoke its active tokens.
Disable Tool
Auto-Execute
Remove a specific tool from an agent's allowlist to prevent further misuse.
Rotate Credentials
Requires Approval
Invalidate and reissue API keys or secrets suspected of exposure.
Block API
Auto-Execute
Deny further calls from an agent or IP range to a specific downstream API.
Isolate Tenant
Requires Approval
Cut off a tenant's workspace from all shared resources during a critical incident.
Notify SOC
Auto-Execute
Page the on-call security analyst with full session and evidence context.
Create ServiceNow Incident
Auto-Execute
Open a tracked incident ticket with severity, evidence and affected assets pre-filled.
Trigger SOAR Playbook
Auto-Execute
Kick off a multi-step automated playbook across connected security tooling.

Time	Action	Target	Triggered By	Status	Duration
Sep 10, 2026 09:41:02 AM	Kill Session	S-6f3a8b2e (Customer Support Agent)	AI-PROMPT-INJECTION-001	Success	0.9s
Sep 10, 2026 09:38:47 AM	Disable Tool	delete_user (Data Analyst Agent)	AI-TOOL-ALLOWLIST-004	Success	0.4s
Sep 10, 2026 09:31:15 AM	Rotate Credentials	STRIPE_API_KEY	priya.nair@acme.com	Success	3.2s
Sep 10, 2026 09:28:03 AM	Block API	api.crm.update (Scheduler Agent)	AI-RATE-LIMIT-011	Success	0.6s
Sep 10, 2026 09:24:41 AM	Pause Execution	S-0c1d2e33 (Research Agent)	AI-JAILBREAK-SHIELD-007	Success	0.7s
Sep 10, 2026 09:19:52 AM	Isolate Tenant	Tenant: globex-staging	mark.smith@acme.com	Pending	—
Sep 10, 2026 09:14:05 AM	Create ServiceNow Incident	INC0043218	Automated	Success	1.4s
Sep 10, 2026 09:10:52 AM	Trigger SOAR Playbook	Contain & Notify — Data Exfiltration	Automated	Success	2.1s
Sep 10, 2026 09:07:31 AM	Notify SOC	On-call SOC (PagerDuty)	Automated	Success	0.3s
Sep 10, 2026 09:02:18 AM	Stop Agent	DevOps Agent	AI-CREDENTIAL-ACCESS-005	Failed	4.8s

Contain & Notify — Data Exfiltration
Active
Critical prompt injection + data exfiltration attempt
184 runs 12 min ago
Credential Compromise Response
Active
Secret leakage guardrail block on production key
61 runs 47 min ago
Runaway Agent Circuit Breaker
Active
Tool call volume exceeds 3x baseline for 5 minutes
96 runs 2 hours ago
Tenant Isolation Escalation
Disabled
Multiple critical threats from a single tenant within 15 minutes
8 runs 3 days ago

Available Response Actions