# Incident Response

URL: https://avispa.ai/agent-teams/incident-response/

Security team

Turns SOC escalations into approved, single-endpoint containment and independently verified recovery, using Microsoft Defender and SentinelOne.

## Who's on the team

- **Incident Commander** · Lead · Runs the case and owns the containment and release gates.
- **Case Triage Coordinator** · Works the case queue every weekday.
- **Communications Liaison** · Sends timestamped, factual updates that separate facts from hypotheses.
- **Containment Verifier** · Independently reads the vendor action and endpoint state after every execution.
- **Endpoint Response Executor** · Executes only the exact approved single-endpoint action, inside its approval window.
- **Evidence Custodian** · Keeps evidence with its source, collection time, digest, classification and custodian.
- **Recovery Coordinator** · Plans and verifies recovery.

## How a team arrives

1. 1 · **Import** · Arrives switched off
2. 2 · **Connect** · Credentials stay with you
3. 3 · **Discovery** · Learns how you work
4. 4 · **You approve** · Its plan and its limits
5. 5 · **Activate** · Routines switch on

## Controls it works inside

- Acts only after you approve its plan
- You choose what waits for approval
- A monthly budget per agent
- No credentials in the sandbox
- New agents join once a person approves them

- The approver, executor and verifier are always different roles.
- Only the Endpoint Response Executor can act on endpoints, with an explicit tool allowlist.
- Releasing an endpoint needs a fresh approval.

**More: when and where it works, and what it documents**

## When it works

- **Daily Case Queue Review** · Weekdays at 08:00
- **Daily Containment Review** · Weekdays at 12:00
- **Monthly Response Readiness Drill** · The 1st of each month at 10:00
- **Weekly Evidence Integrity Audit** · Mondays at 09:00

Routines arrive switched off. You turn each one on.

## Where it works

- Jira
- Microsoft Defender
- Microsoft Sentinel
- SentinelOne
- ServiceNow
- Slack

Each connection is granted per agent, read-only or full. [All integrations](https://avispa.ai/integrations/)

## What it documents

- An indexed evidence set.
- Timestamped case updates.
- Monthly readiness drill outcomes.

[All agent teams](https://avispa.ai/agent-teams/) · [Next: IT & Security](https://avispa.ai/agent-teams/it-security/)

## Onboard Incident Response with us.

[Book a demo](https://avispa.ai/book-a-demo/) · [Watch it work](https://avispa.ai/#watch)