Triage and coordinate security incidents
An AI agent can validate incoming reports and classify cases from the evidence. Workflows route the case to its owner, page on-call, and track the criteria for escalation or recovery.
Tools for incident management
MCP servers for the tools used in these examples.
PagerDuty
GmailAutomation examples and starter prompts
Paste a prompt into Claude Code, Microsoft Copilot, or Codex connected to Tracecat MCP. Adapt it to your tools and test before deployment. Human tool approvals and advanced case features require Enterprise.
Triage and validate incident reports
Build me an incident intake workflow in Tracecat. Accept reports from the security inbox in Gmail, a Slack shortcut, and tool webhooks. Have an AI agent validate each report, dedupe it against open cases, fill the required case fields, and close obvious false alarms with a polite explanation to the reporter. Everything else becomes a case in the triage queue. First help me understand how this maps to RS.MA-02 and why validation before assignment protects the on-call analyst. Ask me what minimum fields a workable case needs. Talk me through which false-alarm patterns are safe to auto-close.
Categorize and prioritize incidents
Build me a case classification automation in Tracecat. When a case enters triage, have an AI agent read the evidence, set the incident category from our taxonomy, and score priority from asset criticality, data sensitivity, and spread. Route the case to the owning queue, and page through PagerDuty when priority crosses our threshold. First help me understand how this maps to RS.MA-03 and how a consistent taxonomy improves both response and reporting. Ask me what categories and priority levels we use today. Talk me through auditing the agent's classifications so trust builds over time.
Escalate incidents on clear criteria
Build me an escalation automation in Tracecat. Encode our escalation criteria: priority level, blast radius, regulated data, or response time exceeded, and when a case meets one, open an Incident.io incident, page the incident commander through PagerDuty, and post the case summary with the timeline so far. Record what triggered the escalation on the case. First help me understand how this maps to RS.MA-04 and why escalation criteria should be decided before the bad day, not during it. Ask me who can declare and who must be told. Talk me through de-escalation when the trigger turns out to be wrong.
Apply recovery initiation criteria
Build me a recovery gate in Tracecat. For active incidents, track the recovery criteria as case tasks: containment confirmed, root cause known well enough, and eradication verified. When all pass, notify the incident commander in Slack that recovery can begin, kick off the recovery checklist, and record the decision and timestamp on the case. First help me understand how this maps to RS.MA-05 and why starting recovery too early reinfects environments. Ask me who owns the recovery decision today. Talk me through which criteria can be machine-verified and which need human sign-off.
NIST CSF 2.0 mapping: RS.MA
Official NIST category: Incident Management. Responses to detected cybersecurity incidents are managed
The controls and implementation examples below are NIST source material. The automation prompts above are Tracecat-authored starting points, not evidence of compliance or full control coverage.
- RS.MA-01IR-6IR-7IR-8SR-3SR-8
The incident response plan is executed in coordination with relevant third parties once an incident is declared
- Detection technologies automatically report confirmed incidents
- Request incident response assistance from the organization's incident response outsourcer
- Designate an incident lead for each incident
- Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)
- RS.MA-02IR-4IR-5IR-6
Incident reports are triaged and validated
- Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities
- Apply criteria to estimate the severity of an incident
- RS.MA-03IR-4IR-5IR-6
Incidents are categorized and prioritized
- Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)
- Prioritize incidents based on their scope, likely impact, and time-critical nature
- Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation
- RS.MA-04IR-4IR-5IR-6IR-7
Incidents are escalated or elevated as needed
- Track and validate the status of all ongoing incidents
- Coordinate incident escalation or elevation with designated internal and external stakeholders
- RS.MA-05IR-4IR-8
The criteria for initiating incident recovery are applied
- Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated
- Take the possible operational disruption of incident recovery activities into account
Control text and SP 800-53 Rev 5 references from the official NIST CSF 2.0 and OLIR releases.
Build your own security automation
Adapt a starter prompt with your coding assistant, choose where AI agents or fixed workflows fit, and test with your tools.