SOARIn development
Automate repeatable security work without hiding authority or evidence.
An playbook system built around approvals, connector permissions, action history and rollback-aware design.
CONCEPT / SOAR WORKFLOW
Evidence triggerEvaluate
Human approvalAuthorise
Action receiptAudit
Illustrative interface · not live customer dataAutomation becomes a new risk when actions are opaque, over-privileged or impossible to reverse.
Capability map
Built around a complete working loop.
Availability will be documented capability by capability; this list describes the intended module boundary.
Human approval gates
Scoped connector permissions
Evidence capture
Action history
Rollback-aware patterns
Workflow
Evidence moves forward without losing its source.
- 1Trigger with evidence
- 2Evaluate conditions
- 3Request approval
- 4Execute scoped action
- 5Record outcome
Use cases
Alert enrichment
Account-disable approval
Containment evidence collection
Role-based value
SOC — repeatable response
IT — controlled execution
Risk — action auditability
Deployment and integration
Connect deliberately.
Connector and action availability will be published individually; no autonomous response coverage is currently claimed.
Security and data handling
State the boundary.
Credentials must remain server-side in a dedicated secret boundary with per-action authorisation.
Direct answers
Questions before commitment.
Are playbooks live?
No. The source workflow exists, but production availability still requires route and connector proof.
Can every action be rolled back?
No. The design will label reversibility and require stronger approval for irreversible actions.