Synthetic data & simulated integrations. Every incident, host, identity, indicator and detection source on this page is fabricated for portfolio demonstration. There is no live ServiceNow instance, SIEM, EDR or identity provider connected, and this project is not affiliated with or endorsed by ServiceNow.

Automation Playbooks

Simulated response automation

Each playbook declares the categories it covers, a minimum severity and confidence threshold, and per-action impact. Nothing here calls a real system.

Every high-impact action is gated behind explicit human approval, and approval is recorded in the audit trail before the simulated action is marked executed.

Phishing Containment

Quarantines matching messages, blocks the sender infrastructure and drives credential resets for click-through users.

phishingmin severity: lowmin confidence: 65%

Actions

  • Search mailboxes for matching messageslow impactmay auto-runSimulated integration: SIM-MailGateway
  • Quarantine matched messagesmedium impactmay auto-runSimulated integration: SIM-MailGateway
  • Block sender domain at gatewaymedium impactmay auto-runSimulated integration: SIM-MailGateway
  • Force password reset for click-through usershigh impactapproval requiredSimulated integration: SIM-IdentityProvider

Guardrails

  • · Never quarantines more than the matched dedupe key set.
  • · Password resets always require analyst approval.

Endpoint Isolation & Triage

Collects endpoint forensics and, with approval, network-isolates a host showing confirmed malicious execution.

malwaremin severity: mediummin confidence: 75%

Actions

  • Collect process tree and persistence artifactslow impactmay auto-runSimulated integration: SIM-EDR
  • Submit sample hash to sandboxlow impactmay auto-runSimulated integration: SIM-Sandbox
  • Network-isolate the endpointhigh impactapproval requiredSimulated integration: SIM-EDR

Guardrails

  • · Isolation is never applied to tier0 assets without incident commander sign-off.
  • · Evidence collection always precedes containment.

Identity Compromise Response

Revokes sessions and rotates credentials for identities showing abuse indicators, under human approval.

credential abuseinsider riskmin severity: mediummin confidence: 70%

Actions

  • Snapshot authentication history (24h)low impactmay auto-runSimulated integration: SIM-IdentityProvider
  • Revoke active sessionshigh impactapproval requiredSimulated integration: SIM-IdentityProvider
  • Rotate associated credentialshigh impactapproval requiredSimulated integration: SIM-SecretsVault
  • Notify identity owner and managermedium impactmay auto-runSimulated integration: SIM-Notify

Guardrails

  • · Privileged identities require two-person approval before revocation.
  • · Service accounts are never rotated during a change freeze.

Cloud Exposure Remediation

Reverts risky cloud control-plane changes and links the originating change record.

cloud misconfigurationmin severity: lowmin confidence: 80%

Actions

  • Snapshot current resource policylow impactmay auto-runSimulated integration: SIM-CloudTrail
  • Query external access loglow impactmay auto-runSimulated integration: SIM-CloudTrail
  • Revert resource policy to privatehigh impactapproval requiredSimulated integration: SIM-CloudControlPlane

Guardrails

  • · Policy reverts are gated behind change-management approval.
  • · Snapshots are taken before any mutation.

Exfiltration Throttle & Preserve

Preserves netflow evidence and throttles egress from a suspected exfiltration source.

data exfiltrationmin severity: highmin confidence: 75%

Actions

  • Preserve netflow and archive metadatalow impactmay auto-runSimulated integration: SIM-SIEM
  • Correlate against scheduled export calendarlow impactmay auto-runSimulated integration: SIM-CMDB
  • Throttle egress from affected nodehigh impactapproval requiredSimulated integration: SIM-NetworkControl

Guardrails

  • · Egress throttling on production services requires business service owner acknowledgement.
  • · No destructive action is ever taken on data stores.