ARCHITECTURE · RESPONSE ENGINE

The response engine.

Response actions run on the same fabric the events sit in — no second platform. Two execution models:

Execution models

Direct contain — the engine calls the source's control plane: revoke an OAuth grant in M365, isolate a host via EDR, block a domain at the proxy. Idempotent, signed, and audit-logged in the fabric itself.
Playbook graph — for multi-step responses (collect → triage → notify → contain → rollback), define a YAML playbook. The engine executes it as a state machine with per-node retries and approval gates.

Reversibility is first-class. Every contain action records its inverse so an analyst (or the engine, on a soft-failure rollback) can undo it with one call. td case rollback ca_4Jx… walks the case timeline backward.

Action catalog

Containment actions are typed, idempotent operations against a source's own control plane. Each declares whether it can be safely retried and whether it can be reversed.

Action	Surface	Idempotent	Reversible
`isolate-host`	EDR	Yes	Yes
`revoke-sessions`	IdP	Yes	Yes
`disable-account`	IdP / directory	Yes	Yes
`block-domain`	Proxy / DNS	Yes	Yes
`quarantine-file`	EDR	Yes	Partial
`kill-process`	EDR	No	No

Playbook graph

Multi-step responses are authored as a YAML graph and executed as a state machine with per-node retries, timeouts, and approval gates. The same primitives run whether a human or a trigger starts them.

PLAYBOOK · ransomware-containment.yml

playbook: ransomware-containment
on: case.severity >= critical
steps:
  - collect:  { snapshot: [host, memory] }
  - notify:   { channel: "#sec-oncall", page: ir-lead }
  - approve:  { role: ir-lead, timeout: 5m, on_timeout: hold }
  - contain:  [isolate-host, disable-account, block-domain]
  - verify:   { recheck: 60s }
rollback: auto-on-failure

Approval gates & safe mode

Any node can require human approval before it runs, scoped to a role and a timeout. Until a tenant promotes a playbook out of safe mode, destructive actions stage the change and wait for a click instead of executing — so you can watch the engine make the right call before you let it act unattended. Every gate decision, approval, and timeout is recorded on the case timeline as a signed event.

← PREV Detection Pipeline NEXT → Deployment Models