Playbooks and response
Automate the routine. Keep the decisions.
A playbook is attached to a detection and runs on every match. It gathers, compares and proposes; whether it acts depends on the mode you chose and the ceiling you set for that tenant.
Blocks
Thirteen block types.
Built in a visual editor; every run leaves a step-by-step trace.
| Block | What it does |
|---|---|
| Enrich | Reputation and context for IPs, hashes, users and domains. |
| Correlate | Find related alerts and events across sources and time. |
| Query telemetry | Run a saved query against the store and attach the result. |
| AI investigate | Let the investigation agent gather context with bounded read-only queries. |
| Collect file | Pull a file off the endpoint into evidence. |
| Similar-alert history | How were alerts like this one resolved before? |
| Compare | Check the gathered facts against a pattern. |
| Branch and gate | Continue only if a condition holds. |
| Run workflow | Call another playbook as a step. |
| Advisory verdict | Ask the model for a verdict, confidence and evidence grade. |
| Triage note | Write the note into the alert or case. |
| Stage response | Queue an action for confirmation, or execute it in auto mode. |
| Notify or ticket | Send to Slack, Teams, email, Jira, TheHive or a webhook. |
Modes
Pre-stage or auto, under a ceiling.
- Pre-stage: the playbook proposes actions and a person confirms them from the alert.
- Auto: actions execute only on a confident-malicious verdict, and only up to the automation ceiling set for that organization.
- Every execution is attributed to the operator or the playbook and lands in the audit trail.
- Each response fires exactly once per alert, thanks to deterministic run identifiers.
Actions
What a playbook can do.
Isolate or release a host
Through the endpoint agent, with the containment mode you choose.
Kill a process, block an application
On the host, by process or by hash and image.
Collect a triage package
The one-shot snapshot of the places that matter.
Disable an account, revoke sessions
In Okta or Microsoft Entra ID.
Block an IP at the firewall
Add the address to a FortiGate block group.
Quarantine an email
Move or soft-delete a message in Microsoft 365.
Isolate a device in your EDR
Microsoft Defender for Endpoint.
Notify
Where the outcome goes.
- Webhook with an HMAC signature, Slack, Discord, Microsoft Teams, email.
- Jira and TheHive for teams that keep their tickets elsewhere.
- Forward to an upstream SIEM when alerts travel further.
See XenXDR on your own telemetry.
A 30-minute walkthrough on fictional data, then a pilot in your environment. No slides, no pressure.