Playbooks with approval, rollback and an honest simulate mode
ThirdEYE ships 58 built-in playbooks and a builder for your own. Each playbook has an approval mode, and nothing changes on a real system until you turn live mode on.
The problem
Manual response is slow and inconsistent
The same containment steps are repeated by hand, with different results each time.
Unchecked automation is risky
Blocking an account or isolating a host on a wrong verdict has real cost.
Nobody can say what actually ran
Without a timeline and audit trail, automation is hard to review.
How ThirdEYE addresses it
Match a playbook
The investigation selects the best-matching playbook from the built-in catalog and any custom playbook set to automatic.
Apply the approval mode
Manual, semi-automatic (uses the decision thresholds), AI-recommended (a model judges each run and defaults to requiring approval if it fails) or automatic.
Run or simulate
Actions run in simulate mode by default and are labelled as simulated. In live mode they call a configured provider, respect protected targets and a per-hour cap, and are audited.
Review and roll back
A unified execution timeline shows what ran, and the rollback centre can undo reversible actions.
Key capabilities and their status
Status labels reflect what is in the product today.
SOAR playbooks: 58 built-in, builder, AI generator, approvals, rollback
A catalog of 58 playbooks, a no-code builder, an AI generator that drafts a playbook for human review, approval modes and a rollback centre.
Live response actions (EDR, identity, firewall)
Response actions run in simulate mode by default. Live mode is opt-in (RESPONSE_MODE=live) and needs a configured provider: Wazuh, CrowdStrike, Microsoft Defender, Entra ID, Okta or a firewall webhook. Protected targets and a per-hour cap are supported.
Note: Tested with mocked transports. Not validated against live third-party systems in this review. Simulated actions must never be described as live remediation.
Decision thresholds with logged justification
Configurable block, escalate and investigate thresholds decide what happens automatically and what waits for a person; each decision keeps its justification.
Case management with SLA, evidence chain and reports
Escalated alerts become cases with tasks, relationships, evidence chain-of-custody, SLA pause and resume, and Markdown reports.
Ticketing sync: TheHive, ServiceNow, Jira, GLPI, Zammad
Cases can be pushed to and synced from an external ticketing system, with a secret-protected inbound webhook.
Note: Tested against mocked HTTP. TheHive is the provider being validated first; the others are optional.
Where it fits in your environment
Live response providers include Wazuh, CrowdStrike, Microsoft Defender, Entra ID, Okta and a generic firewall webhook. Which ones you use depends on your stack.
The AI playbook generator drafts a playbook from a plain-English description and loads it into the builder for review. Nothing is saved or run automatically.
Scope to know about
- Live mode is opt-in (RESPONSE_MODE=live) and needs a configured provider.
- Provider integrations are tested with mocked transports and have not been validated here against live systems.
- Simulated actions are never reported as live remediation.
Walk through a playbook run.
Book a walkthrough with the team. We will show the platform end to end, tell you what is production-ready and what is not, and discuss how it would sit next to your existing SIEM.