Actions
Actions
The closed set of operations this system can perform. Anything not listed here cannot be executed — actions are registered, never generated.
| Action | Base risk | Rollback | Expected post-state |
|---|---|---|---|
| read_logs Read logs for an entity | 0 | — | — |
| query_threat_intel Look up an indicator in threat intelligence | 0 | — | — |
| notify_analyst Notify or page a security analyst | 0 | — | — |
| create_case Open a case for the incident | 0 | — | — |
| require_mfa_reauth Force re-authentication with a second factor | 10 | clear_mfa_requirement | session re-verified |
| clear_mfa_requirement Lift a step-up authentication requirement | 10 | require_mfa_reauth | session unchallenged |
| rate_limit_account Throttle an account's request rate | 15 | remove_rate_limit | request_rate <threshold |
| remove_rate_limit Lift a rate limit from an account | 15 | rate_limit_account | request_rate unthrottled |
| force_password_reset Invalidate a password and require a new one | 20 | irreversible | credential rotated |
| revoke_session Invalidate an active session or token | 25 | reissue_session | session invalid |
| reissue_session Allow a new session after re-authentication | 25 | revoke_session | session valid |
| quarantine_email Isolate a message from every recipient's mailbox | 25 | release_email | message isolated |
| release_email Return a quarantined message to its recipients | 25 | quarantine_email | message delivered |
| adopt_playbook Adopt a drafted playbook as the procedure for this class of incident | 35 | retract_playbook | playbook adopted |
| retract_playbook Withdraw an adopted playbook | 35 | adopt_playbook | playbook withdrawn |
| adopt_report Adopt a drafted post-incident report as the record of what happened | 35 | retract_report | report adopted |
| retract_report Withdraw an adopted post-incident report | 35 | adopt_report | report withdrawn |
| block_ip Deny traffic from an address at the perimeter | 35 | unblock_ip | traffic_from_ip denied |
| unblock_ip Allow traffic from a previously blocked address | 35 | block_ip | traffic_from_ip allowed |
| disable_account Deactivate an account | 45 | enable_account | account inactive |
| enable_account Reactivate a disabled account | 45 | disable_account | account active |
| isolate_host Remove a host from the network, keeping EDR reachable | 55 | rejoin_network | network isolated, edr reachable |
| rejoin_network Return an isolated host to the network | 55 | isolate_host | network joined |
| rotate_credentials Invalidate a credential everywhere it is trusted | 65 | irreversible | secret invalidated |
| wipe_host Erase a host | 100 | irreversible | — |
Base risk is only the starting point. It rises with blast radius, production environment, low diagnostic confidence, and novelty — and never falls. An action cannot argue its way into a lower tier.