ContainmentEvery live containment action, its approval, its result and its Undo, in one place.
Approve what the agents want to do, see what ran, undo it, and control the holds.
What changed on this page
Approval is the first job: tiles on top, and plan cards with Approve and Reject in view instead of an Actions menu in a nine-column table (the menu and the table are still there, under Actions).
Plans read at a glance: tier, target chips with their kind, the first reason in one line; steps, API, rollback and why it waits sit behind Details. The same card is used on the case page.
Holds are switches with a live "lifted until" countdown; a one-time exception uses friendly target kinds and an hours slider. Switch & rules gathers the kill switch, live mode, auto-handled playbooks, the false-positive loop and protected targets.
Every change still asks for a reason of 8 characters or more, the server still checks every role, four-eyes and every hold, and a disabled button says which role it needs.
Reading the plans that wait for a decision…
Nobody decided these before the case moved on, or they are already decided. Kept for the record; they cannot be approved.
Containment actionsEvery containment action and proposal, newest first: what was done, to what, where, who approved it or which playbook ran it, and what happened. Use Actions on a row to approve or reject a proposal (soc.admin or soc.ciso), undo an executed action (operator and above) or open its case; each asks for a reason, recorded with your name. A held action was recorded and alerted but not done (an observation hold). Undo runs the recorded rollback and counts as a false positive. There is no hourly cap on automatic containment (DEC-119); a second fix on the same subject within 24 hours is never automatic: it is listed here as a proposal that needs approval, and an ITSM problem ticket is opened for it.
Loading…
| Time | Case | Action | Target | State | Actions | |||
|---|---|---|---|---|---|---|---|---|
| Loading… | ||||||||
Holds
Switch on = held: recorded and alerted, never done.
Loading…
One-time exceptions
last 7 daysReading the remediation state…
Plans for this case
What the SOC has done
Undo needs a reason and the operator role or above. Approve and Reject need soc.admin or soc.ciso, and never the person who asked. Holds need soc.admin.