Incident Response Workflows

Streamline your security incident response with automated workflows and standardized procedures.

Automation

Incident workflows automate routine tasks and ensure consistent, documented responses to security threats.

---

What Are Incident Workflows?

Incident workflows are automated, repeatable processes that guide your security team through incident response from detection to resolution.

Feature	Description
Automated Triage	AI-powered prioritization and assignment
Standardized Playbooks	Pre-built response procedures
Approval Workflows	Multi-stage approval for critical actions
Documentation	Automatic audit trail and reporting

---

Standard Incident Lifecycle

1️⃣ Detection

Stage 1: Detection

Threat detected by detection rules, AI analysis, or manual reporting.

Automated Actions:

Action	Description
Create incident record	New incident in system
Assign severity score	AI-calculated priority
Notify on-call team	Alert responsible personnel
Generate initial timeline	Capture event sequence

2️⃣ Triage

Stage 2: Triage

Initial assessment and prioritization by security analyst.

Analyst Actions:

Action	Description
Review alert context	Examine AI insights
Confirm true/false positive	Validate the threat
Adjust severity if needed	Refine prioritization
Assign to specialist	Route to appropriate team

3️⃣ Investigation

Stage 3: Investigation

Deep analysis to understand scope and impact.

Investigative Tasks:

Task	Description
Examine related events	Find correlated activity
Check for lateral movement	Assess spread
Identify affected systems	Scope the impact
Document findings	Record in incident record

4️⃣ Containment

Stage 4: Containment

Isolate threat to prevent further damage.

Containment Options:

Option	Use Case
Block malicious IPs	External attack sources
Isolate compromised hosts	Prevent lateral movement
Quarantine malicious files	Stop malware spread
Disable compromised accounts	Credential theft

Speed vs. Accuracy

Containment should be fast but targeted. Over-containment can cause business disruption.

5️⃣ Eradication

Stage 5: Eradication

Remove threat and close security gaps.

Remediation Actions:

Action	Description
Remove malware/backdoors	Clean infected systems
Patch vulnerabilities	Close entry points
Reset compromised credentials	Secure accounts
Update security rules	Prevent recurrence

6️⃣ Recovery

Stage 6: Recovery & Closure

Restore normal operations and document lessons learned.

Final Steps:

Step	Description
Verify systems are clean	Confirm remediation
Monitor for re-infection	Watch for persistence
Generate incident report	Document the incident
Conduct post-mortem	Learn from the event

---

Automation Capabilities

📈 Auto-Escalation

Automatic Escalation

Incidents are automatically escalated based on:

Trigger	Action
Time without response	SLA-based escalation
Severity increase	During investigation
Additional affected systems	Scope expansion
Failed containment	Requires senior attention

👥 Smart Assignment

Smart Assignment

AI-powered assignment considers:

Factor	Description
Analyst expertise	Match skills to incident type
Current workload	Balance team capacity
Shift schedules	Assign to available personnel
Historical performance	Route to effective analysts

📝 Auto-Documentation

Automated Documentation

System automatically captures:

Data	Description
Actions with timestamps	Complete audit trail
Team communication	Chat and notes
Evidence collection	Analysis artifacts
Response times	Workflow stage durations

---

Creating Custom Workflows

Navigate to Settings → Incident Management → Workflows:

Step	Description
1. Define Triggers	Specify when workflow activates (severity, event type, tags)
2. Configure Stages	Add, remove, or modify workflow stages
3. Set Automation	Define automatic actions, approvals, escalations
4. Test and Deploy	Validate logic before production use

---

SLA Management

Set and track Service Level Agreements for incident response:

Severity	Initial Response	Resolution Time
Critical	Under 15 minutes	Under 4 hours
High	Under 1 hour	Under 24 hours
Medium	Under 4 hours	Under 3 days
Low	Under 24 hours	Under 7 days

SLA Configuration

SLAs can be customized in Settings → Incident Management → SLA Configuration.

📊 SLA Breach Handling

When an SLA is breached:

1. Automatic notification sent to management
2. Incident flagged with SLA breach indicator
3. Escalation triggered to next level
4. Breach recorded for reporting and improvement

---

Pre-Built Playbooks

CastellanAI includes playbooks for common incident types:

Playbook	Trigger	Key Actions
Ransomware Response	Ransomware detection	Isolate, preserve evidence, escalate
Brute Force Attack	Multiple auth failures	Block IP, reset credentials, investigate
Data Exfiltration	Large outbound transfer	Block destination, isolate source, audit
Malware Detection	Malware signature match	Quarantine, scan related systems
Insider Threat	Anomalous user behavior	Preserve logs, disable account, investigate

---

What's Next?

Guide	Description
Custom Detection Rules	Create rules to trigger workflows
Threat Remediation	Learn remediation procedures
Generating Reports	Create incident reports
Taking Action	Execute response actions

Need Help?

Our team can help design workflows tailored to your organization. Contact Support