Automate incident containment and mitigation
From a confirmed incident, coordinate endpoint isolation, session revocation, and indicator blocking. Record approvals and results on the case, with rollback steps for blocks that disrupt legitimate activity.
Tools for incident mitigation
MCP servers for the tools used in these examples.
Okta
Palo Alto NetworksAutomation examples and starter prompts
Paste a prompt into Claude Code, Microsoft Copilot, or Codex connected to Tracecat MCP. Adapt it to your tools and test before deployment. Human tool approvals and advanced case features require Enterprise.
Contain compromised endpoints
Build me a containment workflow in Tracecat. From a confirmed-malicious case, isolate the host in CrowdStrike, clear the user's sessions and suspend sign-in in Okta, and post the containment status to the incident channel. Gate each action behind an approval in Slack, and record who approved what on the case timeline. First help me understand how this maps to RS.MI-01 and how containment choices trade speed against business disruption. Ask me which user populations and systems need extra care before isolation. Talk me through which approvals could safely drop away as confidence grows.
Eradicate attacker footholds
Build me an eradication workflow in Tracecat. Take the indicators from a contained incident, sweep the whole fleet for them through CrowdStrike and Defender, remove persistence mechanisms found, force credential resets for touched accounts, and rescan to verify nothing answers. Write the sweep coverage and results to the case. First help me understand how this maps to RS.MI-02 and why eradication without a full sweep invites reinfection. Ask me what fleet coverage our EDR actually has. Talk me through deciding between cleaning a host and reimaging it.
Block attacker infrastructure
Build me a blocking automation in Tracecat. From a case's confirmed indicators, push domains to the DNS filter in Cloudflare, URLs to Zscaler, and IPs to the Palo Alto blocklist, each with an expiry date and the case reference. Include a rollback step that removes a block cleanly if it breaks something legitimate. First help me understand how this maps to RS.MI-01 and why blocks need expiry and provenance to stay maintainable. Ask me which enforcement points we run and who owns them. Talk me through confidence thresholds: which indicators auto-block and which wait for review.
NIST CSF 2.0 mapping: RS.MI
Official NIST category: Incident Mitigation. Activities are performed to prevent expansion of an event and mitigate its effects
The controls and implementation examples below are NIST source material. The automation prompts above are Tracecat-authored starting points, not evidence of compliance or full control coverage.
- RS.MI-01IR-4
Incidents are contained
- Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions
- Allow incident responders to manually select and perform containment actions
- Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization
- Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)
- RS.MI-02IR-4
Incidents are eradicated
- Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions
- Allow incident responders to manually select and perform eradication actions
- Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization
Control text and SP 800-53 Rev 5 references from the official NIST CSF 2.0 and OLIR releases.
Build your own security automation
Adapt a starter prompt with your coding assistant, choose where AI agents or fixed workflows fit, and test with your tools.