Skip to content
Start free

Automate the routine, approve the disruptive

Playbooks run lookups, notifications and tickets on their own. Containment, account changes and edge blocks become proposals, and none of the 25 response actions runs until someone with the role its tier requires approves it.

Start freeBook a demoRead the response docs
  • 25 approval-gated actions
  • 35 security playbooks
  • Hash-chained audit ledger

How it works

From a security event to a recorded result

Playbooks run on the same workflow engine as every other automation, and every decision lands on one ledger.

  1. 01TriggerA security alert, a triage verdict, a new case, a webhook or a schedule starts a playbook.
  2. 02EnrichSteps look up the entity, its indicators and your threat-intel sources, and post what they find.
  3. 03ProposeAnything disruptive is filed as a proposal, with its target and credential pinned.
  4. 04ApproveEditors approve notifications, cases and indicator blocks. Containment and account changes need an admin.
  5. 05RunThe action runs in Tracix, through the collector on a host, or through the tool you bound with your own credential.
  6. 06RecordThe proposal, the decision and the result land on a hash-chained ledger you can verify.

Playbooks

Start from 35 security playbooks

Install a playbook for alert handling, enrichment, phishing, identity, endpoint or cloud response. It lands as a draft workflow with the credentials you pick, ready to test against a sample event.

  • Triggers on critical alerts, triage verdicts, new cases, webhooks and schedules
  • Lookups, notifications and tickets run straight away; containment steps file proposals
  • Some playbooks add an analyst confirmation that rejects the step if nobody answers within a day

Approvals

The action decides who approves it, not the playbook

Every response action carries a blast tier. A playbook or an agent can propose anything, but only the role the tier requires can approve it, and the approval runs exactly what was proposed.

  • Blast tiers

    From observe and notify to destructive or broad, each action has one of four tiers.

  • Editors and admins

    Editors approve tiers 0 and 1. Containment, account changes and edge blocks need an admin.

  • Pinned when filed

    The target and the credential are fixed when the proposal is filed, so approval runs what was reviewed.

  • Filed once

    A re-delivered event or a resumed run finds its proposal instead of filing a second one.

Audit ledger

A ledger you can verify, not only read

Triage verdicts, proposals, approvals, rejections and results land on one append-only ledger. Each entry's SHA-256 hash covers the entry before it, so an edited, dropped or reordered entry breaks the chain.

  • Verification recomputes the chain and names the first entry that does not match
  • Agents and people write to the same ledger, each entry naming its actor
  • Compliance evidence packs record whether the ledger was intact when they were generated

Better together

Response on the same platform as detection

Playbooks start from detections, triage verdicts and cases in the same workspace, and an approved edge block can go out as a reviewed network change.

Response actions

All 25 actions, by blast tier

The tier decides who may approve an action, whoever proposed it. Nothing in this catalog runs without an approval.

Blast tierWhat it changesActionsApproved by
0 · Observe and notifyNothing on any targetNotify the SOC, open a case, attach evidence, add to a watchlist, request forensic collectionEditor
1 · Reversible platform changeState inside Tracix, or a read-only scan of files on a hostBlock or unblock an indicator, remove from a watchlist, enable or disable a detection rule, scan host files with YARAEditor
2 · Disruptive containmentSessions, processes, network access and credentials, reversible but feltDisable a user, revoke sessions, force a password reset, disable an API key, contain or release a host, kill or end a process, quarantine or restore a file, block or unblock an IP at the edgeAdmin
3 · Destructive or broadHard to undo, or wide in reachQuarantine mailbox content, reimage a hostAdmin

Admins bind each action to a vendor action and credential, such as CrowdStrike Falcon, Microsoft Defender, Okta or Cloudflare. An approved action with no binding becomes a task for a person to mark done.

FAQ

Questions security teams ask first

Talk to a security engineer
Can a playbook contain a host without a person?
No. A step that would contain a host, change an account or block an address at the edge files a proposal instead of acting, and an admin approves it. Lookups, notifications and tickets run straight away.
Which tools can approved actions run through?
Tracix itself, the collector on a host whose owner allowed host response, edge ACLs on Arista EOS and Nokia SR Linux through configuration management, or a vendor action you bind with your own credential. An unbound action becomes a task for a person.
Do I need an AI model?
No. Only the playbooks with an AI step, such as writing an alert brief or triaging a phishing report, need a model credential. Everything else runs without one.
Can someone change the audit trail?
Not without it showing. Each ledger entry's hash covers the entry before it, and verification recomputes the chain and names the first entry that does not match.

Install a playbook and approve its first proposal

Pick a playbook from the library, connect the tools it calls, and watch its first proposal wait for the right person.

Start freeRead the guide