Skip to content
← All use cases

Incident response with approvals

One alert queue for everything, and a response that waits for a person where it should.

Alerts from identity, data, video, cloud and the platform in one model and one severity scale, grouped into incidents with an owner and an SLA, worked by a responder agent whose risky steps wait for approval, and closed with a review that links the evidence.

For SRE, Security operations, IT operations

Download the brief(PDF)

Start freeTalk to us
Investigator console
The workflow "Contain a high-risk sign-in": an identity-risk trigger, a condition on risk, and three actions (notify, create a case, revoke the session), each with the permission it is authorized against and what happens on error.The workflow "Contain a high-risk sign-in": an identity-risk trigger, a condition on risk, and three actions (notify, create a case, revoke the session), each with the permission it is authorized against and what happens on error.
Trigger, condition and actions, each with the permission it needs. Shown with demo data.

The situation

A camera goes dark, a finance account signs in from a new country and a pipeline falls behind, in three tools with three paging rules. The on-call engineer pieces it together at 3 a.m. and the post-mortem is a document nobody finds again.

How it works

Step by step, and the product each step happens in.

  1. 01

    One queue across pillars

    Every pillar’s alerts share one model and one severity scale, and repeats are folded by dedupe key.

    In Operational Intelligence

  2. 02

    Group it into an incident

    Related alerts correlate into an incident with an owner, an SLA and an escalation policy with on-call rotation.

    In Operational Intelligence

  3. 03

    Respond with a workflow

    A workflow notifies, opens a case and contains access, each action authorized as the person who triggered it.

    In Workflows & Agents
    Investigator console
    The workflow "Contain a high-risk sign-in": an identity-risk trigger, a condition on risk, and three actions (notify, create a case, revoke the session), each with the permission it is authorized against and what happens on error.The workflow "Contain a high-risk sign-in": an identity-risk trigger, a condition on risk, and three actions (notify, create a case, revoke the session), each with the permission it is authorized against and what happens on error.
    Trigger, condition and actions, each with the permission it needs. Shown with demo data.

  4. 04

    Let the responder agent help

    The ops responder reads alerts, acknowledges and assigns, and can run a remediation; risky steps wait for approval.

    In Workflows & Agents

  5. 05

    Review and learn

    A structured review links the evidence, and analytics report volume, precision, MTTA and MTTR by source.

    In Operational Intelligence

What you get

  • One place to look

    Every pillar’s alerts in one queue, ranked on one scale.

  • Speed without blind automation

    Workflows and agents act fast, and destructive steps still wait for a person.

  • Response times you can measure

    MTTA and MTTR by source, from the same records the incident was worked in.

The products involved

Questions, answered

Does it page our existing tools?

Yes. Connectors reach PagerDuty and Opsgenie, Slack and Teams, and ServiceNow and Jira Service Management.

Can we try a workflow without it acting?

A dry run plans and authorizes every step as a real run would, and takes none of them.

Related use cases

Incident response with approvals · ProjectX