Automate the 80% so analysts own the 20%

SOAR automation runs pre-written scripts on a match condition. ManySignal automation runs dynamically — enrichment and investigation steps are selected based on the specific alert context, not a static script. The system determines which enrichment sources are relevant based on the alert type and entities involved.

Yes. Common multi-step workflows — open Jira ticket, look up asset in CMDB, check user in IdP, run IP reputation, assign to on-call analyst — all run in parallel automatically when an alert fires. Analysts receive the completed workflow result, not a list of steps to execute.

Enrichment and investigation steps run automatically without approval — they're read-only. Containment actions (disable account, isolate endpoint, block IP) require approval by default. Approval requirements are configurable per action class. Fully autonomous execution is available for actions your team has explicitly authorized.

Response integrations include: Okta, Entra ID, Active Directory (account management); CrowdStrike, SentinelOne, Defender (endpoint control); Palo Alto, Fortinet, Cisco ASA (network blocking); AWS, Azure, GCP IAM (cloud access control); Jira, ServiceNow, PagerDuty (ticketing and alerting). Full list on the integrations page.

ManySignal's automation dashboard tracks: alerts auto-closed vs. escalated, analyst time saved per alert (based on configured manual workflow time), mean time to triage vs. pre-automation baseline, and automation coverage percentage per data source. These metrics feed directly into the quarterly SOC KPI report.

The first automated triage results appear within hours of connecting data sources. Automation coverage reaches 70–80% of alert volume within the first two weeks as behavioral baselines initialize. The typical customer sees meaningful analyst time savings — measured as alerts closed without analyst review — starting in week one, reaching full coverage in weeks three to four. No playbook authoring or scripting is required to achieve this baseline.

Yes. Automation scope is configurable per detection type, data source, and entity classification. Common partial-automation patterns: automate all cloud alert enrichment but keep endpoint alerts manual for analyst review; automate false-positive closure for specific noisy rules while requiring analyst review for escalations from those same rules; automate enrichment only while keeping triage disposition manual. The system accommodates any combination.

ManySignal generates a complete, immutable audit trail for every automated decision: which agent made the decision, what data it evaluated, what confidence score it assigned, what action it executed, and at what timestamp. Automated closures include the full evidence package and triage rationale — more documentation than most human-reviewed closures produce. Auditors and compliance teams consistently accept ManySignal's automated decision records as equivalent to human investigation documentation.

Failed automation actions escalate immediately to the analyst queue with a notification showing what action was attempted and the failure reason. The case remains open and is flagged as requiring manual intervention. ManySignal retries transient API failures automatically (3 retries with exponential back-off). Persistent integration failures trigger an operations alert to the security team. No alert is silently lost due to a downstream API failure.