Response automation
SIEM → SOAR rules that run on their own when an event arrives: they open incidents or really block devices.
Rules
0
Activein force
0
Auto-blockcaution
0
Evaluationreal time
On ingest
Response automation
Add, edit and status — stored on the server
No records
Create a rule: e.g. “New device → Open incident”. It will be evaluated automatically with every event entering the SIEM.