Actions & Approvals
3 incidents awaiting a decision · 14 actions awaiting approval. Actions outside the auto-approve policy wait here for a Vault engineer or customer approver.
Pending (14)
CriticalXDR-4821Cortex XDRAI 94%
Isolate endpoint ENG-WS-114
CP-03 · Isolate CUI-enclave asset · Critical → Approve (conf < 95%)
CriticalXDR-4821Cortex XDRAI 94%
Quarantine file by SHA256 on all endpoints
CP-04 · Quarantine file · Critical → Auto (held with parent incident)
HighXDR-4821Strata Cloud ManagerAI 94%
Block 185.220.101.47 via SCM EDL on all NGFWs and Prisma Access
CP-08 · Block IP/URL via SCM EDL · High → Approve
CriticalXDR-4821Defender for Office 365AI 94%
Soft-delete phishing message and block sender domain
CP-11 · Delete email · Critical → Auto (held with parent incident)
CriticalXDR-4821Entra IDAI 94%
Revoke sessions for j.reyes
CP-10 · Revoke sessions · Critical → Auto (held with parent incident)
HighENTRA-RS-338Entra IDAI 88%
Reset password and require MFA re-registration
CP-12 · Reset password / MFA · High → Approve
HighENTRA-RS-338Defender for Office 365AI 88%
Remove malicious external forwarding rule
CP-13 · Remove malicious inbox rule · High → Approve
HighENTRA-RS-338Entra IDAI 88%
Temporarily block sign-in for m.alvarez
CP-09 · Disable user · High → Approve
HighENTRA-RS-338Strata Cloud ManagerAI 88%
Add Lagos source IP to SCM EDL
CP-08 · Block IP via SCM EDL · High → Approve
HighPUR-DLP-0912Defender for Office 365AI 78%
Recall message and soft-delete internal copy
CP-11 · CUI mail remediation · Needs Review → Approve
HighPUR-DLP-0912Vault SOCAI 78%
Notify machinist’s manager
CUI business-impact workflow · Customer approval
HighPUR-DLP-0912Vault SOCAI 78%
Open DFARS impact review (no clock)
DFARS impact review · No automatic clock
CriticalSCM-DNS-5512Cortex XDRAI 96%
Isolate ERP server HP-ERP-01
CP-02 · Isolate server · Critical → Approve (servers always require approval)
History
| Executed | Incident | System | Action | Approved by | Result | |
|---|---|---|---|---|---|---|
| Oct 8, 07:28:00 PT | SCM-DNS-5512 | Strata Cloud Manager | Block tunneling domain via SCM EDL | AI SOC (policy) | executed | |
| Oct 8, 04:27:00 PT | XDR-4817 | Cortex XDR | Killed process and quarantined comsvcs MiniDump tool on HP-FS-01 | AI SOC (policy) | executed | |
| Oct 8, 02:19:00 PT | MDO-1177 | Defender for Office 365 | Soft-deleted WildFire-malicious attachment from 3 mailboxes | AI SOC (policy) | executed | |
| Oct 7, 10:00:00 PT | SCM-WF-772 | Cortex XDR | Isolated ENG-WS-066 pending scan | D. Mercer (Vault) | executed |