Incident Response
When the platform's own detection surface raises the security posture, the response is not a note in a separate console. It is an action taken on the same governed substrate and written to the same tamper-evident record as everything else.
Response on the governed record
- On the ledger. Response actions are written to the activity ledger, so what was done in response, and by whom is a first-class, tamper-evident question.
- The threat-level enforcer. Transport tightens automatically when the detection pipeline raises the posture, access is constrained rather than left to a human to remember to constrain.
- Governed like all data. A response action is authorized through the same deny-closed governance as any other consequential act.
Figure: incident response on the governed substrate. A raised posture drives the threat-level enforcer to tighten transport; the response action is authorized and recorded on the tamper-evident ledger. Cross-domain enforcement (cyan) is on the roadmap.
Table equivalent
| Element | Status | Note |
|---|---|---|
| Response recorded on the ledger | Wired | Tamper-evident, attributable |
| Threat-level enforcer | Wired | Tightens transport automatically on raised posture |
| Governed authorization of the action | Wired | Deny-closed, same as any consequential act |
| Cross-domain enforcement | Roadmap | 0 of 12 paths reachable today |
Related topics
- Threat detection, what raises the posture.
- Security Operations overview, the pipeline this belongs to.
- Governance (Deny-Closed), the authorization behind a response action.