Pre-stage
The playbook does everything up to the action, then stops. Staged actions are listed as proposed under Automated steps on the alert page. An analyst reviews them and carries out the ones they agree with from the host's page under Response (the event graph links straight there), so the action runs with that analyst's identity.
Auto
A response action runs without confirmation when all of the following hold:
- the playbook step is in auto mode;
- the advisory verdict is malicious with at least 80 percent confidence;
- the organization's guardrails allow it.
If any condition fails, the action is staged instead and the run trace says why. When a guardrail held an action back, the organization's leads get an Action waiting for approval notification.
Auto-close and auto-escalate have their own conditions: the verdict must reach 80 percent confidence, analysts must have agreed with enough of the rule's recent verdicts, and auto-close also needs evidence grade A or B.
Guardrails
Settings › Organizations › the organization › Automation guardrails limits what playbooks may do automatically for that organization:
| Setting | Effect |
|---|---|
| Auto-close | Lets playbooks close confident-benign alerts. |
| Auto-escalate | Lets playbooks open cases on confident-malicious verdicts. |
| Automatic actions up to severity | Above this severity, every action is staged. |
| Always require an analyst for | Actions that are never run automatically for this organization. |
A provider can give a cautious customer tight guardrails and a customer who signed for it looser ones, without changing any playbook.
Reversing an action
Every automatic action is recorded with the run that took it and in the audit log. Isolation and application blocks are lifted from the host's page under Response. Account actions taken in an identity provider are reversed there.