Taking Action on Threats

Execute response actions to contain and remediate security threats.

Rollback Capabilities

All actions include rollback capabilities and maintain a complete audit trail for compliance.

---

Response Actions Overview

CastellanAI provides automated and manual response actions to quickly contain threats and minimize damage.

Capability	Description
AI-Suggested Actions	AI analyzes threats and suggests appropriate responses
Manual Execution	Security teams can manually trigger actions
Rollback Support	Undo actions within the rollback window
Audit Trail	Complete logging of all actions taken

---

Available Response Actions

🚫 Block IP

Block IP Address

Immediately block malicious IP addresses at the firewall level.

Common Uses:

• Brute force attacks from external IPs
• Command & control server communications
• Data exfiltration attempts
• Port scanning and reconnaissance

Rollback Window: 24 hours

Scope

IP blocks apply at the network perimeter. Internal traffic may require additional controls.

🔒 Isolate Host

Isolate Endpoint

Disconnect a compromised endpoint from the network to prevent lateral movement.

Common Uses:

• Confirmed malware infections
• Ransomware detection
• Suspected lateral movement
• Privilege escalation attempts

Rollback Window: 48 hours

Business Impact

Host isolation disconnects the system completely. Coordinate with stakeholders before executing.

📦 Quarantine File

Quarantine File

Move suspicious files to a secure quarantine location for analysis.

Common Uses:

• Malware file detection
• Suspicious PowerShell scripts
• Trojan or backdoor executables
• Potentially unwanted programs (PUPs)

Rollback Window: 7 days

👁️ Add to Watchlist

Add to Watchlist

Monitor suspicious entities with enhanced logging and alerting.

Common Uses:

• Suspicious user accounts
• Known threat actor IPs
• Compromised credentials
• High-risk endpoints

Rollback Window: 30 days

🎫 Create Ticket

Create Incident Ticket

Automatically create tickets in your ticketing system.

Common Uses:

• Medium/High severity events requiring investigation
• Policy violations
• Compliance incidents
• Security audit findings

Rollback Window: N/A (ticket remains for audit)

---

How to Execute Actions

📋 From Event Details

From Event Details

1. Navigate to Dashboard → Events
2. Click on any security event to view details
3. Review AI-suggested actions in "Recommended Actions"
4. Click Execute on the desired action
5. Confirm execution in the dialog

🔔 From Alerts

From Alert Notifications

1. Receive alert via Teams/Slack/Email
2. Click the "View Details" link in the alert
3. Review event context and suggested actions
4. Execute appropriate response action

⚙️ Manual Execution

Manual Action Execution

1. Navigate to Dashboard → Actions
2. Click "New Action" button
3. Select action type and enter required parameters
4. Review and execute

Custom Actions

Manual execution allows targeting specific entities not linked to a security event.

---

Action Lifecycle

Stage	Description
1. Suggested	AI analyzes the threat and suggests appropriate actions
2. Pending	Action queued for execution, awaiting confirmation
3. Executed	Action successfully executed, state captured for rollback
4. Rolled Back	Action undone within the rollback window

---

Rollback Windows

Action Type	Rollback Window	Notes
Block IP	24 hours	Network rules removed
Isolate Host	48 hours	Endpoint reconnected
Quarantine File	7 days	File restored to original location
Add to Watchlist	30 days	Enhanced monitoring removed
Create Ticket	N/A	Ticket remains for audit trail

🔄 How to Rollback an Action

1. Navigate to Dashboard → Actions
2. Find the executed action in the list
3. Click "Rollback" button (if within window)
4. Confirm rollback in the dialog
5. Action will be reversed and logged

Rollback Limitations

Some actions cannot be rolled back after certain events (e.g., if malware executed after quarantine was rolled back).

---

Best Practices

Practice	Description
Review Event Context	Always review full event details before executing
Start Less Disruptive	Begin with watchlist before escalating to isolation
Use Rollback Windows	Actions can be undone if needed
Document Decisions	Add notes explaining your rationale
Monitor Results	Verify execution status in Actions dashboard

⚠️ Common Mistakes to Avoid

Mistake	Impact	Solution
Isolating without stakeholder notice	Business disruption	Coordinate before critical actions
Blocking IP without investigating	May block legitimate traffic	Review context first
Ignoring rollback windows	Permanent action	Plan for potential reversal
Skipping documentation	Compliance gaps	Always add action notes

---

What's Next?

Guide	Description
Incident Workflows	Create automated incident response workflows
Investigating Events	Security event investigation techniques
Threat Remediation	Complete threat removal procedures
Generating Reports	Document your response actions