Automaton | Response automation Early access

Automation you can read before it runs.

Once a case is decided, there's still work to do. Someone opens the ticket, tells the right channel, looks up the file hash and, sometimes, isolates the machine. Automaton handles those steps. Each automation is written down where your team can review it. Tickets, messages and lookups can run on their own. Anything that changes your systems or accounts, like isolating a device or disabling a user, waits for a person to say yes.

Ask about early access The rules it runs under

Automaton / Runs / Confirmed phishing, case #2187 Example1 step waiting

Notify. Posted the case summary to the security channel in Slack.
Track. Opened a Jira issue for the finance team with the evidence attached.
Enrich. Looked up the attachment hash in VirusTotal and added the result.
Contain. Isolate LT-0442. Current state shown, waiting for a second person.

Approve isolationDecline

Automaton at work

See Automaton handle the follow-up.

From a decided case to the last approval.

What the video shows

The case is closed. The work isn't. Someone still has to tell the security channel, open a ticket for finance, look up the attachment, isolate the laptop and note it all on the case. These are the small, repetitive steps that get missed at the end of a long night.
Automation that can isolate a laptop can isolate the wrong one.
Introducing Automaton. Automation you can read before it runs. Response automation for security teams, from WardTower.
Every step, in plain view. An automation is a short list of steps your team can read. There are no hidden scripts, and no step can reach a service an administrator hasn't approved. Messages, tickets and lookups run on their own, a change to a record needs one approval, and containment needs two.
AI can draft it. A person approves it. Your analysts or an AI agent can write an automation. Before any version runs, someone other than its author reviews it, and a new draft never changes what's already running. Here the agent tries to approve its own draft and is refused, then S. Patel reviews and approves it.
Try it on last week's case. A dry run plays an automation against a past case. Lookups run for real, so you see real answers. Nothing is posted, opened or isolated.
Quick where it's safe. Careful where it isn't. Messages, tickets and lookups run on their own. A change to a record waits for one person. Containment waits for two, and never the person who asked.
Look first. Check after. Before it isolates anything, Automaton reads the device's current state and checks your never-contain list. Afterwards it checks that the change took. It never sends the same change twice.
Approve the exact action. Not the whole playbook.
No keys of its own. Every call on record. Automaton reaches your tools through Omni with a pass for one call at a time. Every run, approval and call is recorded with the case it belongs to, and one switch pauses all containment for your company.
It works with the tools your team already lives in: Slack, Microsoft Teams, email, Jira, Confluence, ServiceNow, PagerDuty, Okta, VirusTotal, AbuseIPDB, urlscan and GreyNoise. It also works with your own web services, once an administrator registers them in Omni and says which operations are allowed.
Tell us the steps you'd stop doing by hand. Automaton is in early access, and the first automations come from the teams working with us.

What it does

The follow-up work after a decision.

The steps are small and repetitive, and they're also where things get missed at the end of a long night. Automaton does them the same way every time and keeps a record.

Tell the right people

Post to a Slack channel or send an email when a case reaches a point someone needs to know about.

Open the ticket

Create or update a Jira issue with the case summary, so the fix gets tracked where your engineers already work.

Look things up

Check a file hash or a domain against VirusTotal and add the answer to the case.

Act on the decision

Isolate a device through your EDR once a person has approved it, with the device's current state shown first.

The rules it runs under

Quick where it's safe, careful where it isn't.

A lot of automation is built to do as much as possible on its own. Automaton is built the other way around. It does the safe things without fuss and asks before anything that could hurt.

One exact targetAn action that changes something points at one device, account or record, and shows its current state before you approve.
Changes wait for a personMessages, tickets and lookups can run on their own. Anything that changes your systems or accounts, like isolating a device, waits, and the person who asked can't approve their own request.
No keys of its ownAutomaton reaches your tools through Omni, the same way Steward and your analysts do.
A short list of placesAn administrator registers each outside service it may call, and which operations are allowed there. Everything else is refused.
One switch for all of itA single setting stops every outside call at once, for the day you need everything to go quiet.
Everything on the recordEvery run, approval and call is recorded with the case it belongs to.

With Steward

Decide in the case, act from the same place.

When an analyst reaches a decision in Steward, the follow-up steps can start from there. The approver sees the case, the evidence and the exact action side by side, so the approval is an informed one rather than a click on a pop-up.

Automaton is in early access. We're working with a small number of teams to decide which automations come first. If you have a list of steps you'd love to stop doing by hand, we'd like to see it.

Ask about early access

Steward / Cases / #2187 ExampleNeeds analyst

Sources

Suspicious sign-in to a finance mailbox

Opened from an identity alert. Linked to five entities and two earlier cases.

HighIdentityEmailOwner: night shift

Investigation so far

New country, new device. First sign-in from either for this account.
Inbox rule added. Invoices now forward to an outside address.
Harmless explanation tested. No travel or VPN change on record.
Stopped here. The laptop has not reported in, so an analyst decides.