From alert to recovery

Response & Automation

Learn how defenders turn an alert into a coordinated, safe, and auditable response. Practise triage, manage a case, or build a controlled automation workflow.

Find my path Start the foundations

Actioncontrolled and recorded

3learning routes 3practical tools 5safety checks

01

Move from alert to action

Select each stage to see how responders protect people and systems without losing investigation context.

01ReceivePreserve the alert and context 02TriageAssess evidence and impact 03InvestigateEstablish scope and ownership 04ContainApply an approved action 05RecoverRestore and verify safely 06ImproveClose the loop

Stage 1 Receive and preserve the alert

Capture the source alert, time, affected identity or asset, and the evidence already available before the investigation changes anything.

Ask: Can another responder understand what arrived and where it came from?

02

Find your learning path

Choose the response skill you want to practise. The page will highlight the best place to begin.

I am new to response I want to manage a case I want to automate safely

Best match Learn incident triage

Build the vocabulary and judgement needed before installing a response platform.

Recommended firstLearn incident triage Understand cases, ownership, evidence, severity, and the response lifecycle. Level Beginner Setup None Time 45 to 60 min Outcome Turn an alert into a justified priority and next action. Collaborative responseManage an investigation Compare TheHive and IRIS, then create a case, preserve evidence, assign tasks, and record decisions. Level Beginner to intermediate Try 20 min Full lab 2 to 4 hours Outcome Produce a complete, auditable case record. Controlled automationBuild a safe playbook Connect enrichment, approval, containment, notification, and evidence recording. Level Intermediate Try 20 min Full lab 2 to 6 hours Outcome Validate a reversible response workflow with approval boundaries.

03

Build your foundation

Complete these concept guides before operating a case platform or connecting an automated action.

1

Incident responseUnderstanding SIRP

Coordinate cases, people, evidence, decisions, and recovery.

2

Security automationUnderstanding SOAR

Design playbooks with validation, approvals, and reliable failure handling.

04

Choose a tool by outcome

Start with the capability you need today. Each route includes preserved walkthroughs and a practical lab.

CASERun alert-led caseworkTasks, observables, ownership, and decisions IRBuild an evidence-led investigationAssets, provenance, timelines, and reports FLOWOrchestrate repeatable actionsIntegrations, approvals, failures, and rollback

Best starting point for collaborative case management TheHive

Create structured cases, track observables and tasks, and keep analyst decisions together throughout an incident.

Use when

Alert-led collaboration and task ownership are central.

Deployment

Self-managed services in an authorised lab.

Review

Confirm version, connector, and licensing requirements.

Also consider IRIS when investigation timelines, evidence handling, and reporting are central.

Explore TheHive

Related control labsNeed to exercise a containment control?Keep the case or playbook as the audit trail, then use an isolated lab to test the action. Wazuh active response Suricata inline IPS Snort inline IPS

Response loop

Connect detection to response

Carry a supported monitoring decision into a controlled response, then return what you learned to improve future detections.

01 · EscalateTransfer an evidence packageInclude the source alert, timestamps, affected entities, confidence, severity rationale, and the next question to answer. 02 · RespondControl ownership and actionCreate the case, assign decisions, preserve evidence, approve containment, verify recovery, and record the outcome. 03 · ImproveFeed learning back into detectionReturn confirmed findings, false-positive causes, missing telemetry, and recommended rule or playbook changes.

05

Check your response readiness

Complete these checks before changing an account, endpoint, firewall, message, or other real system.

!

Preparation requiredComplete all five safety checks before starting.

I documented the authorised scope, exclusions, systems, and identities. The test uses dedicated accounts, indicators, and disposable assets. Every disruptive action has an owner and approval boundary. I recorded the baseline, rollback method, and recovery verification. Logs and exit criteria cover inputs, decisions, actions, results, and failures.