Advanced
SOC playbooks
Cases and automated responses such as ban and webhook.
Goal
Respond to incidents with SOC cases and playbooks.
Steps
- Ensure Worker is running (SOC jobs).
- Open Advanced → SOC.
- Create or open a case from security findings.
- Attach playbook actions such as Notify, BanIp, or Webhook.
- Execute / enable automation and confirm side effects.
Verify
- Notification received.
- Ban appears in IP ban store / blocked requests.
- Case timeline records the action.