Skip to main content

Incident Response Workflows

Streamline your security incident response with automated workflows and standardized procedures.

What Are Incident Workflows?​

Incident workflows are automated, repeatable processes that guide your security team through incident response from detection to resolution. CastellanAI provides:

FeatureDescription
Automated TriageAI-powered prioritization and assignment
Standardized PlaybooksPre-built response procedures
Approval WorkflowsMulti-stage approval for critical actions
DocumentationAutomatic audit trail and reporting

Standard Incident Lifecycle​

Every security incident follows these stages in CastellanAI:

Stage 1: Detection​

Threat detected by detection rules, AI analysis, or manual reporting.

Automated Actions:

  • Create incident record
  • Assign severity score
  • Notify on-call team
  • Generate initial timeline

Stage 2: Triage​

Initial assessment and prioritization by security analyst.

Analyst Actions:

  • Review alert context and AI insights
  • Confirm true positive / false positive
  • Adjust severity if needed
  • Assign to specialist or escalate

Stage 3: Investigation​

Deep analysis to understand scope and impact.

Investigative Tasks:

  • Examine related security events
  • Check for lateral movement
  • Identify affected systems and data
  • Document findings in incident record

Stage 4: Containment​

Isolate threat to prevent further damage.

Containment Options:

  • Block malicious IPs
  • Isolate compromised hosts
  • Quarantine malicious files
  • Disable compromised accounts

Stage 5: Eradication​

Remove threat and close security gaps.

Remediation Actions:

  • Remove malware and backdoors
  • Patch vulnerabilities
  • Reset compromised credentials
  • Update security rules

Stage 6: Recovery & Closure​

Restore normal operations and document lessons learned.

Final Steps:

  • Verify systems are clean
  • Monitor for re-infection
  • Generate incident report
  • Conduct post-mortem review

Automation Capabilities​

CastellanAI automates routine tasks throughout the incident lifecycle:

Automatic Escalation​

Incidents are automatically escalated based on:

  • Time without response (SLA-based)
  • Severity increase during investigation
  • Detection of additional affected systems
  • Failed containment attempts

Smart Assignment​

AI-powered assignment considers:

  • Analyst expertise and specialization
  • Current workload distribution
  • Shift schedules and availability
  • Historical performance on similar incidents

Automated Documentation​

System automatically captures:

  • All actions taken with timestamps
  • Communication between team members
  • Evidence collection and analysis notes
  • Response times at each workflow stage

Creating Custom Workflows​

Customize workflows to match your organization's requirements.

Workflow Builder​

Navigate to Settings -> Incident Management -> Workflows to create custom workflows:

  1. Define Trigger Conditions - Specify when the workflow should activate (severity, event type, tags)
  2. Configure Stages - Add, remove, or modify workflow stages to match your process
  3. Set Automation Rules - Define automatic actions, approvals, and escalations
  4. Test and Deploy - Validate workflow logic before enabling for production

SLA Management​

Set and track Service Level Agreements for incident response:

SeverityInitial ResponseResolution Time
Critical<15 minutes<4 hours
High<1 hour<24 hours
Medium<4 hours<3 days
Low<24 hours<7 days

SLAs can be customized in Settings -> Incident Management -> SLA Configuration.

What's Next?​

Need Help?​

Our team can help design workflows tailored to your organization.

Contact Support