Automation Platform Integrations

ManySignal's workflow builder provides SOC-native automation: alert enrichment, IOC lookup, user risk scoring, entity resolution, response action execution (isolate endpoint, suspend user), and ticket creation. For complex enterprise workflows, ManySignal integrates with external automation platforms.

For most SOC automation use cases, yes. ManySignal's workflow builder covers alert triage, enrichment, and response automation without requiring a separate SOAR platform. Complex long-running workflows or enterprise IT automation may benefit from dedicated SOAR tools alongside ManySignal.

ManySignal sends PagerDuty incidents for Critical and High severity verdicts, with full investigation context in the incident body. PagerDuty handles on-call routing and escalation. When ManySignal resolves an investigation, it can automatically resolve the PagerDuty incident.

Yes. ManySignal supports outbound webhooks on any verdict or investigation event. This enables integration with any external system — Slack, custom APIs, internal tools — without requiring a native connector.

Yes. ManySignal's workflow builder supports conditional branching: if severity is Critical AND entity is a privileged user, execute isolation; if severity is Medium, create a Jira ticket and wait for analyst review.

ManySignal's automation is security-outcome-focused: it is optimised for the SOC response workflow with pre-built security actions. General-purpose SOAR platforms have broader enterprise automation capabilities (HR workflows, IT provisioning) that ManySignal doesn't attempt to replace.

Yes. ManySignal's inbound webhook receiver and alert API allow external systems to trigger ManySignal investigations and workflows. A vulnerability scanner finding a critical CVE can trigger a ManySignal hunt campaign via API call.

Yes. High-impact actions (account suspension, network isolation) can be configured to require analyst approval before execution. The approval request is sent via Slack or Teams with one-click approve/reject buttons.

ManySignal tracks: automation coverage rate (% of alerts handled without human touch), mean time to automated verdict, false positive rate per automation rule, and analyst override rate. These are visible in the SOC performance dashboard.

Failed automation actions are logged with the error context and an alert is sent to the configured notification channel. ManySignal includes retry logic for transient failures and escalates to human review when automation cannot proceed.