Catalogue and your own
Enable ready-made templates or write advanced conditions from a blank playbook.
PLAYBOOK Trigger, condition, action
Case Manager
Automate case creation and escalation with playbooks. Start from the catalogue, tune conditions to your thresholds, and see every run on record.
Screenshots are taken from a demo tenant; organisation names and data are entirely fictional.
Playbooks are grouped by module: CTI/APT, Intelligence Wire, IoC, Dark Web, Vulnerability, Ransomware, Compromised Assets, ASM and Phishing. Examples: an intelligence case when a tracked actor's timeline gets a new event; a critical case when a CVSS 9.0+ vulnerability appears on a monitored asset; an alert 14 days before a TLS certificate expires; an automatic takedown request for a new look-alike domain.
What it does
Run history
Each playbook shows how often it ran and when it last ran, and pauses in one click.
Threshold conditions
Conditions use fields such as score, CVSS, sector, country, asset type and days remaining.
How it works
-
01
Trigger
Pick an event: a new finding, a new listing, a new victim post, a content change.
-
02
Condition
Define when the event becomes a case: "Turkish finance sector", "CVSS ≥ 9.0", "score ≥ 85".
-
03
Action
Open a case, raise its severity, start a takedown request or notify the team.
What you get
- Repetitive triage moves to the machine.
- Thresholds are the same for everyone; decisions do not depend on who is on shift.
- What the automation did can always be audited.
Scenarios featuring this module
Typosquatted domain with a fake login page
Shortly after appearing in certificate transparency logs, the freshly registered domain began serving a copy of the organisation's login page that posted credentials to a third-party server.
3 modules
Other modules
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.