An automated response is only as good as the verdict behind it. ThirdEYE therefore separates deciding to act from acting.
Simulate is the default
Response actions such as blocking an address, disabling an account or containing a host run in simulate mode by default. They are recorded as simulated, with a note on what would have been called. Nothing changes on any system.
Going live
An administrator enables live mode (RESPONSE_MODE=live) and configures at least one provider, such as Wazuh, CrowdStrike, Microsoft Defender, Entra ID, Okta or a firewall webhook. In live mode:
- A list of protected targets cannot be acted on.
- A per-hour cap limits how many actions can run.
- Every attempt, whether it succeeds, fails or is refused, is written to a hash-chained audit log.
- Reversible actions can be undone from the rollback centre.
Approval modes
Each playbook has an approval mode: manual, semi-automatic (using the decision thresholds), AI-recommended (a model judges each run and defaults to requiring approval if the call fails) or automatic.
A caution
The provider integrations are covered by tests with mocked transports. Validate each one against a non-production target before relying on it.