SOAR & Case ManagementDetect & Respond

Automate the response. Keep the human in the loop.

Netgraph SOAR is native to the platform — code-first, workflow-orchestrated playbooks with a visual canvas, not a bolted-on acquisition. Playbooks trigger from any detection plane, autonomy is graduated by policy-as-code — single, dual or auto approval per action class — and every pending action sits in a durable HITL queue where approving re-invokes the exact tool. Around it: full case management, from alert→case hyperlinks to evidence vault to PICERL checklists that progress themselves.

Native, code-first playbooksSingle / dual / auto approvalDurable HITL queuePICERL auto-progressContainment with deploy receipts

Book a demo →Why Netgraph →

What is SOAR (Security Orchestration, Automation & Response)?

SOAR turns the manual steps after a detection — enrich, decide, contain, notify, document — into orchestrated playbooks, so response takes minutes instead of hours. Netgraph's SOAR is code-first (playbooks live in Git with reviews and tests, not in a drag-and-drop canvas that breaks on upgrade) and policy-gated: each action class is configured for single approval, dual approval, or full autonomy, with a durable human-in-the-loop queue that survives restarts and re-invokes the exact approved action.

What ships in the module

Orchestration, approvals and cases — one connected loop.

Code-first playbooks

Workflow-orchestrated playbooks defined as code with a visual canvas on top — native to the platform, triggered from any detection plane: SIEM, EDR, NDR, cloud, UEBA.

Graduated autonomy

Policy-as-code decides how much trust each action class earns: single approval, dual approval, or fully automatic. Tighten or loosen the ladder without rewriting a playbook.

Durable HITL approvals

Pending actions are persisted at the API boundary — they survive restarts — and approving re-invokes the exact tool. Inline Approve/Reject in the Agent Console, plus dedicated HITL Approvals Runner and Escalation & HITL Queue consoles.

Full case management

Alert→case hyperlinks, Case-ID search, default L2 assignee with an on-call picker, evidence-vault attachments with tags, a semantic timeline and audit-to-comments — the whole investigation in one record, exportable as a PDF case report.

PICERL checklists

SANS PICERL incident checklists auto-progress as the agent investigation writes back — while preserving every human edit. The methodology tracks itself; the analyst stays in charge.

On-call responder directory

A responder directory synced to the knowledge base and Agentic AI — assignment and escalation know who is actually on call.

Alert Take-Action menu

Enrich, TIP lookup, runbook, add-to-case, suppress and mark-FP straight from the alert — with a knowledge-base feedback loop so every disposition makes the next one smarter.

Deterministic approvals

SOAR playbook approvals update paused runs deterministically in place — the run you approved is the run that continues, not a re-fire.

Containment orchestration

Push containment to EDR, firewalls, proxies, AD and zero-trust via enabled integrations — with deploy receipts confirming what actually landed where.

Autonomy you can govern

Approve once. The exact tool runs — nothing else.

Most SOAR approval flows approve an intention; Netgraph approves an invocation. The pending action is persisted at the API boundary with its full parameters, and approval re-invokes precisely that tool call — no drift between what the analyst saw and what executed. The autonomy ladder is policy-as-code, so a containment action can require dual sign-off while an enrichment runs automatically.

Per-action-class policy: single, dual or auto — graduated, not all-or-nothing.
Queue survives restarts — approvals are durable state, not in-memory hope.
Inline Approve/Reject in the Agent Console; dedicated HITL queue consoles for the backlog.
Every push to EDR, firewall, proxy, AD or zero-trust returns a deploy receipt.

Functionality map

Module functions at a glance

Function	What it does	Where it lives
Cases	Case records with alert→case links, Case-ID search, evidence vault, semantic timeline, audit-to-comments, PDF report export	SOC ▸ Detect & Respond ▸ Cases
Playbook Triggers	Wire playbooks to detections from any plane	SOC ▸ Detect & Respond ▸ Playbook Triggers
Orchestrate	Code-first playbooks with visual canvas; containment pushed via enabled integrations with deploy receipts	SOC ▸ Detect & Respond ▸ Orchestrate
HITL queues	Durable approval queue — HITL Approvals Runner + Escalation & HITL Queue; inline Approve/Reject in the Agent Console	Operations ▸ Agentic SOC ▸ HITL queues
Autonomy policy	Policy-as-code: single / dual / auto approval per action class	Playbook + policy definitions
PICERL checklists	SANS-methodology checklists that auto-progress on agent write-back, preserving human edits	Case detail ▸ PICERL
Take-Action menu	Enrich / TIP / runbook / add-to-case / suppress / mark-FP with a KB feedback loop	SOC ▸ Detect ▸ Alerts
On-call directory	Responder directory synced to the knowledge base and Agentic AI; on-call picker for case assignment	Case assignment + knowledge base

Common questions

SOAR & Case Management — asked and answered

How is Netgraph SOAR different from a bolted-on SOAR product?+

Bolted-on SOAR spends most of its playbook steps fetching context from other tools' APIs. Netgraph playbooks read the knowledge graph directly — the host, identity, and blast-radius context is already there — so playbooks are shorter, faster, and far less brittle. MTTR for automated playbooks runs at 15 minutes or less.

Do automated actions run without human approval?+

Only where you configure them to. Every skill carries a side-effect class and a policy: read-only enrichment can be autonomous, while consequential actions (isolate host, disable account) wait in a durable approval queue. Approvals are audited and re-invoke the exact tool call that was reviewed.

Can playbooks survive an audit?+

Yes — playbooks are versioned in Git with PR history, and every execution logs its full decision trace to the hash-chained audit ledger. Our blog post 'SOAR without tears' walks through the approach.

See it live

Trigger a playbook. Approve the exact action.

Book a demo →Browse all modules