Detections & Playbooks

Create detection rule

Name

Description

Event type

Pattern

Severity

Cooldown seconds

Enabled Simulation only

Name

Description

Rule

Enabled Recommend only (no auto-queue) Require manual approval

Action 1

Action 1 payload (JSON)

Action 2

Action 2 payload (JSON)

Action 3

Action 3 payload (JSON)

Name	Type	MITRE	Pattern	Severity	Mode	Status	Actions
Suspicious encoded PowerShell	process_start	`T1059.001`	`-enc` field_contains · cmdline	high	active	enabled	Edit Enabled Simulation
C2 beacon port	network_connect	`T1071`	`4444,8443` port_in_list	critical	active	enabled	Edit Enabled Simulation
Local auth failure burst	agent_status	`T1110`	`failed_login` substring	medium	simulation	enabled	Edit Enabled Simulation

Name	Rule	Mode	Status	Actions
Isolate on C2	C2 beacon port	approval_required	enabled

When auto-remediation is off or approval is required, matched playbooks appear here for review.

Time	Playbook	Endpoint	Status	Notes
03/06 12:52	Isolate on C2	WS-TECH-02	`pending_approval`	Awaiting SOC approval before isolation.	—