SOC monitoring, playbooks and response in Gate

Gate turns raw signals from endpoints into triaged incidents with a repeatable response. This article walks the path from detection to closure and the guardrails that keep automated response safe.

Triage

1. 1Open /gate/detections to see detections ranked by severity and confidence.
2. 2Open a detection to see the device, user, process evidence and related events.
3. 3Use /gate/timeline to view the incident's ordered events and correlate across devices.
4. 4Ask the Cortex SOC panel to summarize and suggest actions; verify against the evidence before acting.
5. 5Mark the detection true positive, false positive or benign, which feeds tuning.

Playbooks and triggers

Playbooks at /gate/playbooks are ordered response steps (notify, collect data, isolate, run script). Triggers at /gate/triggers start a playbook when a detection matches conditions such as severity or rule name.

• Low-risk steps (notify a channel, tag an incident) can run automatically.
• High-impact steps (isolate a device, run a script) should require approval.
• Every step logs who or what ran it and the outcome.

Containment

At /gate/containment you can isolate an endpoint from the network while keeping the management channel open, so investigators can still work on the machine. Release containment once remediation is confirmed.

Scripts and approvals

1. 1A technician drafts a script in /gate/scripts and assigns a risk level.
2. 2Low-risk scripts may run after review; high-risk scripts wait in an approval queue.
3. 3An approver other than the author reviews the code and approves or rejects.
4. 4Approved scripts run against the selected devices, and output is stored with the incident.