Use Case: SOC Operations
On-call escalation automation
A P1 alert fires at 3 AM. The on-call analyst receives a Slack message with the evidence package, the triage agent's findings, and an approve/deny button for account suspension — all within 90 seconds of detection.
The 3 AM page that required 6 browser tabs
On-call escalations are the highest-stress moments in security operations. An analyst woken at 3 AM is immediately disadvantaged: they're not fully alert, they don't have the investigation context built up during the alert's lifetime, and they're under pressure to make decisions quickly. Without pre-built context, they open Okta, then CloudTrail, then the SIEM, then Slack — spending the first 20 minutes assembling information that should have been provided at escalation time.
ManySignal's escalation automation ensures that by the time the on-call analyst reads the PagerDuty page, every relevant piece of context has already been assembled. The first decision is never "where do I look" — it's "do I approve this action."
workflow: on_call_escalation
trigger: case.severity >= P1 OR approve_gated_action_required
pre_escalation:
- complete: automated_triage_investigation
- compile: evidence_package (all sources, formatted)
- draft: plain_english_summary (1 paragraph)
- prepare: approve_deny_actions with consequences
notification:
- pagerduty: create P1 incident with evidence_package
- slack: DM to on-call with summary + action buttons
- sms: fallback if Slack not acknowledged in 5m
approval_response:
- approve: execute_action immediately, log to case
- deny: close_action, add_note to case, notify tier-2
- escalate: add tier-2 to page, maintain case ownership
sla_tracking:
- time_to_notification: < 3m from detection
- time_to_first_response: alert if > 15m
- time_to_action: track per case typeOn-call escalation FAQ
How does ManySignal decide when to escalate to on-call vs. handle autonomously?
Escalation triggers when: the alert score exceeds the configured autonomous-action threshold, the recommended response action requires approve-gated authorization, the case involves a high-value asset (C-suite account, production database, payment system), or the investigation produces conflicting evidence that requires human judgment. Escalation thresholds are configurable per alert category.
What information does the on-call analyst receive with the escalation?
The escalation notification includes: the specific trigger that caused escalation, a one-paragraph plain-English summary of what happened, the triage agent's current findings and confidence score, the specific action awaiting approval (with a one-click approve/deny link in Slack or PagerDuty), and a direct link to the full case in ManySignal's console for deeper investigation.
Does ManySignal integrate with PagerDuty, OpsGenie, and VictorOps?
Yes. ManySignal integrates with PagerDuty (creating incidents and tracking on-call rotation), OpsGenie (alert routing and escalation policies), and Splunk On-Call (formerly VictorOps). The integration creates incidents in the on-call tool with the full ManySignal evidence package attached, so the on-call analyst doesn't need to switch consoles for context.
Can ManySignal reduce unnecessary on-call pages?
Yes. The most common cause of unnecessary on-call pages is alerts that could have been auto-resolved — benign activity that looks suspicious but has a clear innocent explanation. ManySignal's automated triage resolves these before escalation. Customer data shows a 61% reduction in on-call pages within 90 days of deployment, while maintaining the same P1 incident detection rate.
Cut on-call pages by 61% while keeping P1 detection rates constant
Evidence-rich escalations with one-click approve/deny — so 3 AM decisions are made with full context.