Adversary SOAR

Automate your security operations, from alert to resolution.

Graph playbooks that join sensor, SIEM and decision. Watch four agents assemble the flow, then scroll to run it.

Talk to an expert How it works
Inbound connection sentra-agent · network sensor
Port baselineDataSet · PowerQuery
Decoy portssentra-agent
Atypical behaviour?Clef · Workers AI
Alert the analystOn-call analyst
Block IPNetwork quarantine
Scanner fingerprintnmap · probe order
Report PDF · audit
Inbound connection sentra-agent · network sensor
Port baselineDataSet · PowerQuery
Decoy portssentra-agent
Atypical behaviour?Clef · Workers AI
Alert the analystOn-call analyst
Block IPNetwork quarantine
Scanner fingerprintnmap · probe order
Report PDF · audit
run #4f2a · port-scan-responseScroll to run the playbook

What it does

From alert to resolution, hands off.

Every alert enters a playbook: it is enriched with what your tools already know, a score decides and the response goes out on its own. You see the trace.

Integrations ecosystem

Every node in the playbook talks directly to the tool you already have. No glue code, no middleware.

SentinelOneElasticCrowdStrikeSplunkMicrosoft AzurePagerDutyJiraSlackVirusTotalOktaDatadogCloudflareQualysTenableAWS
min

Minutes, not hours

Triage, enrich and respond before an analyst opens the alert. The graph does the repetitive work.

log

Zero dead ends

Every run leaves a full audit trail: inputs, outputs, decisions and timing per node.

The playbook

From port scan to report.

The flow in the hero is a real playbook: eight nodes, two parallel branches and one Clef decision. This is how it catches a scan that looks like nothing normal.

  • 01Observesentra-agent logs every inbound connection with its port from the endpoint itself and ships it to DataSet. No new probes on the network, no changes at the perimeter.
  • 02CompareA PowerQuery asks the SIEM which ports anyone has requested on that host in 90 days. A port nobody has ever asked for is the first signal.
  • 03TemptDecoy ports: the agent answers SYN-ACK on random ports that serve nothing. A legitimate client never touches them; an nmap touches them all.
  • 04DecideClef, on Cloudflare Workers AI, joins the signals (unseen port, decoys touched, scan pace) and says in milliseconds whether the behaviour is atypical.
  • 05RespondA page to the on-call analyst, network quarantine in SentinelOne, the scanner fingerprint from its probe order and a report ready for audit.
run #4f2a · port-scan-response00:02.3
  1. Inbound connection on :8291185.220.101.42
  2. Port baseline0 requests · 90 d
  3. Decoy ports touched7 · SYN
  4. Clef: atypical behaviouryes · 0.97
  5. Page to the on-call analystsent · 0.4 s
  6. IP in network quarantineSentinelOne · 0.6 s
  7. Scanner fingerprintnmap -sS · linear
  8. ReportPDF · ready

More playbooks

More examples, same shape.

Detect, enrich in parallel, decide, respond in parallel, close. Change the trigger and the rest falls into place: a honey API, a fake VPN portal, a reported email, a key in a commit.

Honey API · RASP

From /api/docs to a WAF ban

A package in the app serves obvious endpoints (/api, /api/docs, /api/users) with fixed responses and no backend: nothing to exploit, only something to get caught on.

GET /api/docs
Sequence
Real email
Attack?
Ban IP
Report IP
Reset user
Report
run #a31c · honey-api-recon
  1. TemptThe app exposes /api, /api/docs and /api/users with a fake OpenAPI doc and fixed responses. With no backend there is nothing to exploit.
  2. Read the sequencedocs → version → users within seconds is not a user, it is reconnaissance. And a POST to /api/users with a real user's email is credential stuffing with leaked data.
  3. CutIP ban in the Cloudflare WAF and a report to AbuseIPDB with the evidence.
  4. CloseThe user whose email was used gets a password reset and an MFA check in Entra ID. Report ready.
Cloudflare WAFAbuseIPDBEntra ID
Honey VPN · vpn-honeypots

A leaked password, tried against a portal that does not exist

A fake VPN portal (FortiGate, GlobalProtect, Citrix) that only serves static HTML. Whoever tries to log in brings credentials from some leak.

Decoy login
Real user?
IP reputation
Credential?
Revoke session
Block IP
Leak source
Report
run #77e0 · honey-vpn-login
  1. TemptThe portal answers like a real FortiGate, but it is static HTML: no session, no backend, nothing to break.
  2. CheckDoes the user they try exist in Entra ID? If so, the password comes from a leak, not a wordlist. The IP is checked against VirusTotal.
  3. Decide and cutReal credential: sessions revoked, reset forced and the IP blocked at the perimeter.
  4. CloseFind where the password leaked from (infostealer logs, HIBP) and the report is ready.
Entra IDVirusTotalFortiGate
Email · report button

From the suspicious email to clean mailboxes

A user presses “report”. Before anyone reads it, the playbook already knows whether it is malicious and who else got it.

Reported
URL + file
Recipients
Malicious?
Purge inboxes
Cut domain
Notify
Report
run #c902 · phishing-report
  1. DetectThe report button opens the run with the original email attached.
  2. EnrichVirusTotal analyses the URL and the attachment; Microsoft 365 says how many mailboxes got the same message.
  3. Decide and cutMalicious: purged from every mailbox and the domain blocked in Cloudflare Gateway.
  4. CloseA heads-up to whoever opened it, and the report with the full chain.
VirusTotalMicrosoft 365Cloudflare Gateway
Code · secret scanning

A key in a commit, rotated before anyone uses it

GitHub flags a key in a push. The playbook checks whether it is valid, rotates it and tells whoever pushed it.

Key in push
Valid?
Author
In prod?
Rotate key
Tell author
Clean git
Report
run #5d18 · leaked-secret
  1. DetectGitHub secret scanning finds a key in a commit and calls a webhook.
  2. EnrichThe key is tested against its provider, and the author and repository are looked up.
  3. Decide and cutValid and production: rotated at the provider and the author told on Slack with the new path.
  4. CloseThe commit is rewritten out of history and the report is ready.
GitHubAWSSlack

End-to-end

From consultation to deployment, and beyond.

We build the playbooks with you on top of your tools, leave them running and stay around when your stack changes.

Talk to an expert
Merabytes

A named owner

From the first playbook to the close of every incident. A person, not a portal.