Automate security incident response playbooks across your admin consoles
Stepwork runs the containment steps your team recorded in Okta, CrowdStrike, Microsoft 365, and other consoles, the same way every time, with approval in chat and a timeline.
- Use case
- Incident containment across identity, endpoint, and emailInfoSec & Compliance
- Best for
- Security Operations Lead, IT Security Manager, Security Engineer
- Applications used
CrowdStrike
Okta
Microsoft Entra ID
Microsoft 365Proofpoint
Slack
- Business outcome
- The same containment steps on every incident, with a timeline
The problem
The playbook is a wiki page, and every step is in another console
- Find the user in the identity provider and revoke every session
- Reset MFA and force a new password, one console at a time
- Contain the host, then sign the user out of every app
- Hunt through mailboxes for rules forwarding mail outside
- Pull a phishing email from every inbox it reached
- Rebuild the timeline from chat history for the ticket
Triage
Wherever the alert shows up, it starts the right playbook
Alerts and reports arrive in different consoles and in different shapes. Your tools raise them; Stepwork reads each one where it lives and starts the procedure your team recorded for it.
How it arrives
- SlackSecurity channel message@security j.alvarez approved an MFA push she didn't start. Can we lock her account down?Goes to Compromised account
- Microsoft Entra IDRisky sign-inUser: d.okafor
Risk: High · Atypical travel
Sign-in: Lagos, NG · 02:14Goes to Compromised account
SentinelOneThreatRansomware behavior · Not mitigated Endpoint: OPS-WS-027 Site: ChicagoGoes to Endpoint containment
- Microsoft DefenderAlertSuspicious email forwarding activity
Mailbox: ap@yourcompany.com
Forwards to: an outside Gmail addressGoes to Forwarding rule sweep
Systems
Acts in the consoles your playbooks already name
Your EDR, identity provider, and email security tools raise the alerts. Stepwork doesn't replace them; it works in them. It signs in with a login your team grants, runs the steps you recorded, and reports back in the chat and ticketing tools your team already uses.
- Endpoint: CrowdStrike, SentinelOne, Sophos Central, Microsoft Intune, Jamf
- Identity: Okta, Microsoft Entra ID, Active Directory, JumpCloud, Duo Security
- Email and workspace: Microsoft 365, Google Workspace, Microsoft Defender, Proofpoint, Mimecast, KnowBe4
- Cloud, SaaS, and internal consoles: AWS, GitHub, 1Password, Internal tool, On-prem app
- Approvals and incidents: Slack, Microsoft Teams, Jira, ServiceNow, PagerDuty
Example procedures
Four incident response procedures, card by card
One locks down a compromised account, one contains a host, one sweeps mailboxes for forwarding rules, and one cleans up after a phishing campaign. Swap in your identity provider, endpoint tool, or email security above each one and the steps stay the same.
Lock down a compromised account in Okta
An analyst reports a compromised account in Slack. Stepwork finds the user in Okta and revokes every session, then a rule picks the path: a standard user gets an MFA reset and a forced password change, and an admin is escalated and suspended. Both paths post the timeline back to the thread.
- Slack
- Okta
Swap in your systemsThe steps stay the same. Only the screens change.
Lock down a compromised account in Okta
Webhook
Compromised account report in the Slack security channel
message · security incidents
Output variables
- user_email
- reported_by
Extraction
Look the user up in Okta
Input variables
- user_email
Extracted variables
- user_account
- admin_roles
Execution
Revoke every active session in Okta
Input variables
- user_account
Output
- sessions_revoked
Rule logic
Does the account hold an admin role?
Input variables
- admin_roles
Paths
- If the account holds an admin or other privileged role in OktaThen: Escalate to the security lead in Slack
- OtherwiseThen: Reset MFA factors in Okta
Execution
If an adminEscalate to the security lead in Slack
Input variables
- user_email
- admin_roles
Output
- lead_approval
Execution
If an adminSuspend the account in Okta
Input variables
- user_account
- lead_approval
Output
- account_action
Execution
If a standard userReset MFA factors in Okta
Input variables
- user_account
Execution
If a standard userForce a password change in Okta
Input variables
- user_account
Output
- account_action
Execution
Post the response timeline in the Slack thread
Input variables
- reported_by
- sessions_revoked
- account_action
Drag to explore · pinch to zoom
Step by step
- Someone reports it in SlackAn analyst posts in the security channel that an account looks compromised, with the user's email. That message starts the run, and the run record keeps who reported it.
- Stepwork finds the accountIt looks the user up in Okta by email and reads the account and any admin roles it holds. If no account matches, the run stops instead of guessing.
- Every session endsThe recorded flow revokes the user's active sessions in Okta, so whoever holds them has to sign in again. This runs before the rule, so it happens on both paths.
- The rule checks for admin rolesIf the account holds an admin role, the run takes the top path. A standard user takes the lower path.
- If an adminEscalate to the security lead in Slack
- If a standard userReset MFA factors in Okta
- Admins go to the security leadOnly on the top path: Stepwork pages the security lead in Slack with the account, its roles, and what has been done so far, and waits for the lead to confirm.Only on this path: If an admin
- The admin account is suspendedOnce the lead confirms, the recorded flow suspends the account in Okta instead of resetting it. Nobody signs in as that admin until the investigation clears it.Only on this path: If an admin
- MFA factors are resetOn the lower path, the recorded flow removes every enrolled MFA factor, so the user has to enroll again at their next sign-in.Only on this path: If a standard user
- The password has to changeStepwork sets a temporary password in Okta that must be changed at the next sign-in.Only on this path: If a standard user
- The thread gets the timelineBoth paths end here. Stepwork replies in the original thread with each step, its result, and the time it ran, ready for the incident ticket.
Field map
| From | To |
|---|---|
| SlackReport: user's email | OktaUser search: email |
| OktaProfile: admin roles | SlackEscalation to the security leadAdmins only |
| OktaSessions revoked, account status | SlackTimeline: each step and its time |
Contain a compromised host in CrowdStrike and sign its user out everywhere
A high or critical detection in CrowdStrike starts the run. Once the on-call analyst approves in Slack, Stepwork contains the host, suspends the user in Okta, signs them out of Google Workspace, and opens an incident in Jira with every step and its time.
- Slack
- Okta
Google Workspace
Jira
Swap in your systemsThe steps stay the same. Only the screens change.
Step by step
- The detection comes inCrowdStrike sends a high or critical detection with the host, the signed-in user, and the detection ID. CrowdStrike decides what counts as high or critical; Stepwork starts from its alert.
- A person approves firstBefore anything is contained, the on-call analyst is asked in Slack to approve, with the host and the detection in the message. If they decline, the run stops and the record shows who decided.
- The host is containedThe recorded flow network-contains the host in CrowdStrike, so it can only reach the CrowdStrike console while the team investigates.
- The user is suspendedStepwork suspends the user in Okta and ends their sessions, so a token taken from that laptop stops working.
- Every other session endsThe recorded flow signs the user out of Google Workspace on every device, including phones and browsers that weren't on the contained host.
- The incident gets openedStepwork opens an incident in Jira with the detection and each containment step, its result, and the time it ran.
- The thread gets the linkThe incident link goes back to the Slack thread where the analyst approved, so the team works from one place.
Field map
| From | To |
|---|---|
| CrowdStrikeDetection: host, user, severity | SlackApproval request |
| CrowdStrikeDetection: signed-in user | OktaUser search: email |
| CrowdStrikeHost: containment status | JiraIncident: timelineWith each step's time |
Hourly sweep for mail forwarded outside the company in Microsoft 365
Every hour Stepwork reads the mailboxes in Microsoft 365 that forward mail outside the company and checks each one against the forwards your team approved. Unapproved rules are disabled, the owner is told why, and security gets the list in Slack.
- Microsoft 365
- Excel
- Slack
Swap in your systemsThe steps stay the same. Only the screens change.
Step by step
- The forwarding mailboxes come inStepwork opens Microsoft 365 and reads every mailbox with a rule or setting that forwards mail to an outside address. Each one is one pass through the loop.
- The approved list gets readIt reads the forwards your team has approved in Excel, like a shared mailbox that sends to your accounting firm, once per run.
- The rule checks each forwardInside the dashed frame, a forward to an address that isn't on the approved list goes on to be disabled. Approved forwards stay as they are.
- If not approvedDisable the forwarding rule in Microsoft 365
- OtherwiseApproved forwards stay as they are
Repeats: For each mailbox forwarding outside · 4 mailboxes - The rule gets disabledThe recorded flow removes the forwarding rule from the mailbox in Microsoft 365 and confirms it's gone. Mail forwarded to an outside address is a common sign that someone else is reading the mailbox.Only on this path: If not approvedRepeats: For each mailbox forwarding outside · 4 mailboxes
- The owner hears whyThe mailbox owner gets a message in Slack with the address that was removed and how to ask for an exception if the forward was legitimate.Only on this path: If not approvedRepeats: For each mailbox forwarding outside · 4 mailboxes
- The sweep gets summed upAfter the last mailbox, the Summary card lists each rule disabled, where it forwarded to, and whether the owner was told.Only on this path: If not approved
- Security sees itThe list goes to the security channel in Slack, so a forward that keeps coming back gets looked at as a possible compromise.Only on this path: If not approved
Field map
| From | To |
|---|---|
| Microsoft 365Mailbox: forwarding address | SlackOwner message: address removedUnapproved forwards only |
| Microsoft 365Mailbox: owner | SlackOwner message: to |
| ExcelApproved list: mailbox, address | SlackSecurity summary: forwards left in place |
Pull a phishing campaign from every inbox and reset whoever clicked
An analyst confirms a phishing campaign in Slack. Stepwork pulls the message from every inbox it reached in Proofpoint, then works through the recipients: anyone who clicked the link gets a password reset in Okta and a training assignment in KnowBe4.
- Slack
- Okta
KnowBe4
Swap in your systemsThe steps stay the same. Only the screens change.
Step by step
- The campaign gets confirmedAn analyst posts in the security channel that a reported message is phishing, with its sender and subject. A person makes that call, and Stepwork starts from it.
- The message leaves every inboxThe recorded flow searches Proofpoint for every copy of the message by sender and subject, removes each one, and returns the list of recipients it reached.
- The clicks get readStepwork reads the click log in Proofpoint for the message's links, so the run knows who clicked and who didn't.
- The rule checks each recipientInside the dashed frame, a recipient who clicked goes on to the reset. Anyone who didn't click needs nothing else, since the message is already gone.
- If they clickedReset the password and end sessions in Okta
- OtherwiseThe message is already gone from their inbox
Repeats: For each recipient · 37 recipients - Clickers get a new passwordThe recorded flow ends the recipient's sessions in Okta and sets a temporary password that must be changed at the next sign-in.Only on this path: If they clickedRepeats: For each recipient · 37 recipients
- Clickers get trainingStepwork enrolls the recipient in your phishing training campaign in KnowBe4, so the follow-up doesn't depend on someone remembering.Only on this path: If they clickedRepeats: For each recipient · 37 recipients
- The response gets summed upAfter the last recipient, the Summary card lists how many inboxes the message reached, who clicked, and what was reset and assigned, for the incident write-up.Only on this path: If they clicked
Field map
| From | To |
|---|---|
| SlackReport: sender and subject | ProofpointMessage search: sender, subject |
| ProofpointClick log: recipient | OktaUser search: emailOnly recipients who clicked |
| OktaUser: email | KnowBe4Training campaign: add user |
Flows
The response flows these procedures are built from
Each flow is one recorded change in one console. Procedures run them in order during an incident, and any of them can also run on its own from a request in Slack or Teams.
- Okta
Clear active sessions for user
Finds the user in Okta admin and clears all active sessions, forcing re-authentication everywhere. - Okta
Reset MFA factors for user
Finds the user in Okta admin, resets all enrolled MFA factors, and triggers re-enrollment at next sign-in. - Microsoft Entra ID
Revoke user sessions and tokens
Revokes all active sessions and refresh tokens for a user from the Entra admin center. - Microsoft Entra ID
Reset password with forced change
Resets a user's password in Entra and requires a change at next sign-in. - Microsoft Entra ID
Disable user account
Signs into the Entra admin center, locates the user, and blocks sign-in, disabling the account across Microsoft services. - JumpCloud
Suspend user
Suspends a departing user in the JumpCloud console, cutting SSO, LDAP, and device access. - Duo Security
Deactivate user
Deactivates a departing user in Duo, removing their MFA devices from service. - CrowdStrike
Contain host
Network-contains a specified host from the Falcon console during incident response. - CrowdStrike
Lift host containment
Releases a host from network containment after remediation and verifies connectivity status. - SentinelOne
Disconnect endpoint from network
Disconnects a specified endpoint from the network via the console during response. - Google Workspace
Suspend user account
Signs into the Google Admin console, locates the user, and suspends the account, blocking sign-in while preserving data. - Microsoft 365
Extract external forwarding rules
Extracts mailboxes with auto-forwarding to external addresses, a classic compromise indicator. - Microsoft 365
Disable external forwarding rule
Removes a specified mailbox's external auto-forwarding rule and confirms deletion. - Proofpoint
Block sender domain
Adds a sender domain to the block policy and confirms enforcement. - KnowBe4
Enroll user in training campaign
Adds a specified user to a training campaign, typically for new hires or phishing clickers. 
AWSDeactivate access keys for user
Locates a user's active access keys in IAM and deactivates them, cutting programmatic access.- Proofpoint
Pull a message from every inbox
Searches for every copy of a reported message by sender and subject, removes each one from the mailbox it reached, and returns the list of recipients. - Proofpoint
Read who clicked a link
Reads the click log for a message's links and returns each recipient who clicked, with the time and whether the click was blocked.
More procedures
More incident response procedures
Ready-made procedures in the Marketplace for account takeover, endpoint isolation, and exposed links.
1 more
Okta · Microsoft Entra ID · Duo + 1 moreCompromised account response playbook
For a suspected account takeover, resets the user's MFA factors, clears every Okta session, revokes Entra sessions and tokens, deactivates the Duo account pending re-enrollment, and logs the full response timeline.- Okta · Google Workspace · Microsoft Entra ID
Emergency session revocation sweep
On a suspected compromise, clears all active Okta sessions, signs the user out of Google Workspace on every device, and revokes Entra sessions and tokens in one pass, confirming completion to security. - SentinelOne · Sophos · Slack
Endpoint isolation on ticket escalation
Triggered by an escalated security ticket, disconnects the affected endpoint in SentinelOne or isolates it in Sophos depending on which agent manages it, and posts the isolation confirmation with next steps to the incident thread. 1 more
Dropbox · Box · Miro + 1 morePublic link remediation cycle
Extracts external shared links from Dropbox, external collaborations from Box, and public Miro boards weekly, gives owners a grace window to justify, then revokes links and public access that go unjustified.
Why Stepwork
The same containment steps on every incident, with the timeline kept
Stepwork is a deterministic agent platform: it runs the steps you recorded in each console, in the same order, every time, so a reset never skips the session revoke and a contained host always gets its user signed out. A person can approve in Slack or Teams before a host is contained or an admin is suspended. Every run records each step, the values read, who triggered and approved it, and when, so the run record is the incident timeline. Credentials stay in your vault.
Deterministic agentsProceduresCredentials
Book a DemoFAQ
Common questions
The math
What the manual version costs a security team
Example volumes for a security team of three at a company of about 800 people. Swap in yours.
Illustrative estimate, not a quote. These are example volumes and typical hand times, not a customer's results. Your numbers will differ, and we can work them out with you.
| The manual task | Times a week | Minutes each | Hours a week |
|---|---|---|---|
| Lock down a compromised account across consoles | 3 | 30 | 1.5 |
| Contain a host and sign its user out everywhere | 2 | 25 | 0.8 |
| Check mailboxes for forwarding outside the company | 5 | 15 | 1.3 |
| Pull a phishing email and reset everyone who clicked | 1 | 60 | 1 |
| Write up an incident timeline for the ticket | 6 | 20 | 2 |
- Hours a week
- 6.6
- Hours a year
- 329
- Of one full-time person
- 16%
Example volumes, not a customer's numbers. Minutes are the typical time to do each task by hand. Hours a year assume 50 working weeks.