{ "name": "Time to Contain containment coverage scorecard", "version": "2026-11-04", "read": "2026-11-04", "license": "https://creativecommons.org/licenses/by/4.0/", "publisher": "Time to Contain", "statuses": { "native": "A vendor-maintained integration, built-in action or vendor-published template documents this exact action against a named target.", "partner": "A third-party, community or target-vendor-published integration documents it, or the action is only documented as a proxy for another product.", "custom": "Only a generic HTTP, CLI or script step is shown for the target.", "not documented": "The pages read do not document the action. It may exist." }, "domains": [ { "id": "edr", "name": "EDR" }, { "id": "identity", "name": "Identity" }, { "id": "email", "name": "Email" }, { "id": "cloud", "name": "Cloud" }, { "id": "network", "name": "Network" } ], "actions": [ { "id": "edr_isolate", "domain": "edr", "name": "Isolate host", "definition": "Cut a managed endpoint off from the network while keeping the sensor channel to the EDR console open, so analysts can still investigate." }, { "id": "edr_release", "domain": "edr", "name": "Release isolation", "definition": "Lift a network isolation placed earlier, returning the endpoint to normal connectivity." }, { "id": "edr_kill", "domain": "edr", "name": "Kill process", "definition": "Terminate a named running process on an endpoint, by PID or name, from the response console or API." }, { "id": "edr_quarantine_file", "domain": "edr", "name": "Quarantine file", "definition": "Move a file on disk to the EDR quarantine store so it cannot execute, without deleting the evidence." }, { "id": "edr_run_script", "domain": "edr", "name": "Run script or live response", "definition": "Execute a script or live response command on an endpoint to collect evidence or remediate." }, { "id": "edr_block_hash", "domain": "edr", "name": "Block hash", "definition": "Add a file hash to the EDR blocklist or custom indicator list so it is prevented from running across the estate." }, { "id": "id_disable_user", "domain": "identity", "name": "Disable user", "definition": "Disable, suspend or deactivate a user account in the identity provider so no new sign-in succeeds." }, { "id": "id_pw_reset", "domain": "identity", "name": "Force password reset", "definition": "Invalidate the current credential and require a new password at next sign-in." }, { "id": "id_revoke_sessions", "domain": "identity", "name": "Revoke sessions or tokens", "definition": "End active sessions and revoke refresh or access tokens for a user." }, { "id": "id_mfa_reenroll", "domain": "identity", "name": "Require MFA re-enrolment", "definition": "Reset or delete a user's registered MFA factors so the user must enrol again." }, { "id": "id_remove_group", "domain": "identity", "name": "Remove from group or role", "definition": "Remove a user from a security group or revoke a role assignment to cut inherited access." }, { "id": "em_delete_msg", "domain": "email", "name": "Delete a delivered message", "definition": "Remove a delivered phishing message from user mailboxes, from one mailbox or across many, by message ID, sender or search." }, { "id": "em_quarantine_msg", "domain": "email", "name": "Quarantine a delivered message", "definition": "Move an already delivered message into the administrator quarantine, instead of deleting it, so it can be reviewed or restored." }, { "id": "em_block_sender", "domain": "email", "name": "Block sender or domain", "definition": "Add a sender address or domain to the gateway blocklist so later mail is rejected or quarantined." }, { "id": "em_url_exemption", "domain": "email", "name": "Remove a URL rewrite exemption", "definition": "Delete a URL from the permit or bypass list of the email gateway's URL rewriting and click protection, so it is scanned again." }, { "id": "em_release_quarantine", "domain": "email", "name": "Pull from quarantine", "definition": "Release a held or quarantined message back to the recipient after review." }, { "id": "cl_disable_iam", "domain": "cloud", "name": "Disable IAM user or access key", "definition": "Disable a cloud IAM user, login profile, service account or access key." }, { "id": "cl_revoke_session", "domain": "cloud", "name": "Revoke cloud session", "definition": "Invalidate active cloud sessions or temporary credentials issued to a principal." }, { "id": "cl_isolate_instance", "domain": "cloud", "name": "Isolate or stop an instance", "definition": "Stop, power off or network-isolate a compute instance." }, { "id": "cl_change_sg", "domain": "cloud", "name": "Change a security group or firewall rule", "definition": "Add or remove a rule in a cloud security group, network security group or cloud firewall." }, { "id": "cl_revoke_oauth", "domain": "cloud", "name": "Revoke OAuth app consent", "definition": "Remove a delegated consent grant or enterprise application so a third-party OAuth app loses access." }, { "id": "nw_block_fw", "domain": "network", "name": "Block IP or domain at the firewall", "definition": "Add an IP address, FQDN or URL to a firewall blocklist, address group or deny rule." }, { "id": "nw_block_proxy_dns", "domain": "network", "name": "Block at the proxy or DNS filter", "definition": "Add a URL or domain to a secure web gateway denylist or DNS filter block list." }, { "id": "nw_nac", "domain": "network", "name": "Disable a switch port or NAC quarantine", "definition": "Quarantine an endpoint through network access control, or disable its switch port, so it loses network access." }, { "id": "nw_ndr_list", "domain": "network", "name": "Add to a threat list on the NDR", "definition": "Add an indicator or entity to a watchlist, blocklist or intel feed on a network detection and response tool." } ], "platforms": [ { "slug": "palo-alto-cortex-xsoar", "name": "Palo Alto Cortex XSOAR", "ranked": true, "counts": { "native": 20, "partner": 0, "custom": 0, "not_documented": 5 }, "coverage_share_pct": 80, "read": "2026-11-03", "cells": { "edr_isolate": { "status": "native", "targets": [ "CrowdStrike Falcon: cs-falcon-contain-host", "Microsoft Defender for Endpoint: microsoft-atp-isolate-machine", "Cortex XDR: xdr-endpoint-isolate" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/MicrosoftDefenderAdvancedThreatProtection/Integrations/MicrosoftDefenderAdvancedThreatProtection/README.md", "https://github.com/demisto/content/blob/master/Packs/CortexXDR/Integrations/CortexXDRIR/README.md" ], "read": "2026-11-03" }, "edr_release": { "status": "native", "targets": [ "CrowdStrike Falcon: cs-falcon-lift-host-containment", "Microsoft Defender for Endpoint: microsoft-atp-unisolate-machine", "Cortex XDR: xdr-endpoint-unisolate" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/MicrosoftDefenderAdvancedThreatProtection/Integrations/MicrosoftDefenderAdvancedThreatProtection/README.md", "https://github.com/demisto/content/blob/master/Packs/CortexXDR/Integrations/CortexXDRIR/README.md" ], "read": "2026-11-03" }, "edr_kill": { "status": "native", "targets": [ "CrowdStrike Falcon: cs-falcon-rtr-kill-process", "Cortex XDR: xdr-kill-process-script-execute" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/CortexXDR/Integrations/CortexXDRIR/README.md" ], "read": "2026-11-03" }, "edr_quarantine_file": { "status": "native", "targets": [ "Cortex XDR: xdr-file-quarantine", "Microsoft Defender for Endpoint: microsoft-atp-stop-and-quarantine-file", "CrowdStrike Falcon: cs-falcon-apply-quarantine-file-action" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/CortexXDR/Integrations/CortexXDRIR/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/MicrosoftDefenderAdvancedThreatProtection/Integrations/MicrosoftDefenderAdvancedThreatProtection/README.md", "https://github.com/demisto/content/blob/master/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/README.md" ], "read": "2026-11-03" }, "edr_run_script": { "status": "native", "targets": [ "CrowdStrike Falcon: cs-falcon-run-script", "Cortex XDR: xdr-run-script", "Microsoft Defender for Endpoint: microsoft-atp-live-response-run-script", "SentinelOne: sentinelone-run-remote-script (partner-supported pack)" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/CortexXDR/Integrations/CortexXDRIR/README.md", "https://github.com/demisto/content/blob/master/Packs/MicrosoftDefenderAdvancedThreatProtection/Integrations/MicrosoftDefenderAdvancedThreatProtection/README.md", "https://github.com/demisto/content/blob/master/Packs/SentinelOne/Integrations/SentinelOne-V2/README.md" ], "read": "2026-11-03" }, "edr_block_hash": { "status": "native", "targets": [ "Cortex XDR: xdr-blocklist-files", "CrowdStrike Falcon: cs-falcon-upload-custom-ioc", "Microsoft Defender for Endpoint: microsoft-atp-indicator-create-file", "SentinelOne: sentinelone-add-hash-to-blocklist (partner-supported pack)" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/CortexXDR/Integrations/CortexXDRIR/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/CrowdStrikeFalcon/Integrations/CrowdStrikeFalcon/README.md", "https://github.com/demisto/content/blob/master/Packs/MicrosoftDefenderAdvancedThreatProtection/Integrations/MicrosoftDefenderAdvancedThreatProtection/README.md", "https://github.com/demisto/content/blob/master/Packs/SentinelOne/Integrations/SentinelOne-V2/README.md" ], "read": "2026-11-03" }, "id_disable_user": { "status": "native", "targets": [ "Okta: okta-suspend-user, okta-deactivate-user", "Microsoft Entra ID (Graph User): msgraph-user-account-disable" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/Okta/Integrations/Okta_v2/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/MicrosoftGraphUser/Integrations/MicrosoftGraphUser/README.md" ], "read": "2026-11-03" }, "id_pw_reset": { "status": "native", "targets": [ "Microsoft Entra ID (Graph User): msgraph-user-force-reset-password", "Okta: okta-expire-password", "Google Workspace: gsuite-user-reset-password" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/MicrosoftGraphUser/Integrations/MicrosoftGraphUser/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/Okta/Integrations/Okta_v2/README.md", "https://github.com/demisto/content/blob/master/Packs/GSuiteAdmin/Integrations/GSuiteAdmin/README.md" ], "read": "2026-11-03" }, "id_revoke_sessions": { "status": "native", "targets": [ "Okta: okta-clear-user-sessions", "Microsoft Entra ID (Graph User): msgraph-user-session-revoke", "Google Workspace: gsuite-user-signout, gsuite-token-revoke" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/Okta/Integrations/Okta_v2/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/MicrosoftGraphUser/Integrations/MicrosoftGraphUser/README.md", "https://github.com/demisto/content/blob/master/Packs/GSuiteAdmin/Integrations/GSuiteAdmin/README.md" ], "read": "2026-11-03" }, "id_mfa_reenroll": { "status": "native", "targets": [ "Okta: okta-reset-factor", "Microsoft Entra ID (Graph User): msgraph-user-authenticator-method-delete and the other method-delete commands", "AWS IAM: aws-iam-deactivate-mfa-devices" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/Okta/Integrations/Okta_v2/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/MicrosoftGraphUser/Integrations/MicrosoftGraphUser/README.md", "https://github.com/demisto/content/blob/master/Packs/AWS-IAM/Integrations/AWS-IAM/README.md" ], "read": "2026-11-03" }, "id_remove_group": { "status": "native", "targets": [ "Okta: okta-remove-from-group", "AWS IAM: aws-iam-remove-user-from-group", "Google Cloud IAM: gcp-iam-project-iam-member-remove" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/Okta/Integrations/Okta_v2/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/AWS-IAM/Integrations/AWS-IAM/README.md", "https://github.com/demisto/content/blob/master/Packs/GCP-IAM/Integrations/GCPIAM/README.md" ], "read": "2026-11-03" }, "em_delete_msg": { "status": "native", "targets": [ "Microsoft Graph Mail: msgraph-mail-delete-email (per mailbox)", "Gmail: gmail-delete-mail with gmail-search-all-mailboxes", "Mimecast: mimecast-create-remediation-incident (by message ID or hash)" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/MicrosoftGraphMail/Integrations/MicrosoftGraphMail/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/Gmail/Integrations/Gmail/README.md", "https://github.com/demisto/content/blob/master/Packs/Mimecast/Integrations/MimecastV2/README.md" ], "read": "2026-11-03" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://github.com/demisto/content/blob/master/Packs/Mimecast/Integrations/MimecastV2/README.md", "read": "2026-11-03", "note": "Mimecast remediation incident is documented as a remediation record; the page does not say whether the message is deleted or quarantined, so it is counted under delete only." }, "em_block_sender": { "status": "native", "targets": [ "Mimecast: mimecast-create-block-sender-policy, mimecast-update-block-sender-policy" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/Mimecast/Integrations/MimecastV2/README.md", "read": "2026-11-03" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://github.com/demisto/content/blob/master/Packs/Mimecast/Integrations/MimecastV2/README.md", "read": "2026-11-03", "note": "Mimecast pack documents mimecast-create-managed-url but no command that removes a managed URL entry." }, "em_release_quarantine": { "status": "native", "targets": [ "Mimecast: mimecast-release-held-message" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/Mimecast/Integrations/MimecastV2/README.md", "read": "2026-11-03" }, "cl_disable_iam": { "status": "native", "targets": [ "Google Cloud IAM: gcp-iam-service-account-disable, gcp-iam-service-account-key-disable", "AWS IAM: aws-iam-update-access-key, aws-iam-delete-login-profile" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/GCP-IAM/Integrations/GCPIAM/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/AWS-IAM/Integrations/AWS-IAM/README.md" ], "read": "2026-11-03" }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://github.com/demisto/content/blob/master/Packs/AWS-IAM/Integrations/AWS-IAM/README.md", "read": "2026-11-03", "note": "No command revokes AWS role sessions or cloud tokens. Entra session revocation is counted under identity." }, "cl_isolate_instance": { "status": "native", "targets": [ "AWS EC2: aws-ec2-stop-instances", "Google Compute Engine: gcp-compute-stop-instance", "Azure Compute: azure-vm-poweroff-instance" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/AWS-EC2/Integrations/AWS-EC2/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/GoogleCloudCompute/Integrations/GoogleCloudCompute/README.md", "https://github.com/demisto/content/blob/master/Packs/AzureCompute/Integrations/AzureCompute_v2/README.md" ], "read": "2026-11-03" }, "cl_change_sg": { "status": "native", "targets": [ "AWS EC2: aws-ec2-revoke-security-group-ingress-rule, aws-ec2-authorize-security-group-ingress-rule", "Azure NSG: azure-nsg-security-rule-update, azure-nsg-security-rule-create" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/AWS-EC2/Integrations/AWS-EC2/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/AzureNetworkSecurityGroups/Integrations/AzureNetworkSecurityGroups/README.md" ], "read": "2026-11-03" }, "cl_revoke_oauth": { "status": "native", "targets": [ "Microsoft Graph Applications: msgraph-apps-service-principal-remove, msgraph-apps-service-principal-password-remove" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/MicrosoftGraphApplications/Integrations/MicrosoftGraphApplications/README.md", "read": "2026-11-03", "note": "Removes the enterprise application (service principal) rather than an individual consent grant." }, "nw_block_fw": { "status": "native", "targets": [ "Fortinet FortiGate: fortigate-ban-ip", "Palo Alto Networks PAN-OS: pan-os-register-ip-tag, address group commands" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/FortiGate/Integrations/FortiGate/README.md", "extra_urls": [ "https://github.com/demisto/content/blob/master/Packs/PAN-OS/Integrations/Panorama/README.md" ], "read": "2026-11-03" }, "nw_block_proxy_dns": { "status": "native", "targets": [ "Zscaler Internet Access: zscaler-blacklist-url, zscaler-blacklist-ip" ], "docs_url": "https://github.com/demisto/content/blob/master/Packs/Zscaler/Integrations/Zscaler/README.md", "read": "2026-11-03" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://xsoar.pan.dev/marketplace", "extra_urls": [ "Cisco ISE pack README was not found at the expected repository path on the read date, so no NAC command was confirmed." ], "read": "2026-11-03" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://github.com/demisto/content/blob/master/Packs/VectraXDR/Integrations/VectraXDR/README.md", "read": "2026-11-03", "note": "Vectra XDR pack documents entity and detection tags, notes and assignments, not a block or watch list." } } }, { "slug": "splunk-soar", "name": "Splunk SOAR (Cisco)", "ranked": true, "counts": { "native": 18, "partner": 1, "custom": 0, "not_documented": 6 }, "coverage_share_pct": 76, "read": "2026-11-03", "cells": { "edr_isolate": { "status": "native", "targets": [ "CrowdStrike: quarantine device", "Microsoft Defender for Endpoint: quarantine device", "Carbon Black Cloud (VMware-published): quarantine device", "SentinelOne (SentinelOne-published): quarantine device" ], "docs_url": "https://github.com/splunk-soar-connectors/crowdstrikeoauth", "extra_urls": [ "https://github.com/splunk-soar-connectors/windowsdefenderatp", "https://github.com/splunk-soar-connectors/carbonblackcloud", "https://github.com/splunk-soar-connectors/sentinelone" ], "read": "2026-11-03", "note": "Splunk-published apps for CrowdStrike and Defender are native. The Carbon Black and SentinelOne apps are published by those vendors." }, "edr_release": { "status": "native", "targets": [ "CrowdStrike: unquarantine device", "Microsoft Defender for Endpoint: unquarantine device" ], "docs_url": "https://github.com/splunk-soar-connectors/crowdstrikeoauth", "extra_urls": [ "https://github.com/splunk-soar-connectors/windowsdefenderatp" ], "read": "2026-11-03" }, "edr_kill": { "status": "partner", "targets": [ "Carbon Black Cloud (VMware-published): kill process" ], "docs_url": "https://github.com/splunk-soar-connectors/carbonblackcloud", "read": "2026-11-03", "note": "CrowdStrike app exposes run command and run admin command (RTR) but no named kill action." }, "edr_quarantine_file": { "status": "native", "targets": [ "Microsoft Defender for Endpoint: quarantine file" ], "docs_url": "https://github.com/splunk-soar-connectors/windowsdefenderatp", "read": "2026-11-03" }, "edr_run_script": { "status": "native", "targets": [ "Microsoft Defender for Endpoint: run script", "CrowdStrike: run command, run admin command" ], "docs_url": "https://github.com/splunk-soar-connectors/windowsdefenderatp", "extra_urls": [ "https://github.com/splunk-soar-connectors/crowdstrikeoauth" ], "read": "2026-11-03" }, "edr_block_hash": { "status": "native", "targets": [ "CrowdStrike: upload indicator", "Microsoft Defender for Endpoint: submit indicator", "SentinelOne (SentinelOne-published): block hash" ], "docs_url": "https://github.com/splunk-soar-connectors/crowdstrikeoauth", "extra_urls": [ "https://github.com/splunk-soar-connectors/windowsdefenderatp", "https://github.com/splunk-soar-connectors/sentinelone" ], "read": "2026-11-03" }, "id_disable_user": { "status": "native", "targets": [ "Okta: disable user", "Microsoft Entra ID (Azure AD app): disable user", "AWS IAM: disable user" ], "docs_url": "https://github.com/splunk-soar-connectors/okta", "extra_urls": [ "https://github.com/splunk-soar-connectors/azuread", "https://github.com/splunk-soar-connectors/awsiam" ], "read": "2026-11-03" }, "id_pw_reset": { "status": "native", "targets": [ "Okta: reset password, set password", "Microsoft Entra ID (Azure AD app): reset password" ], "docs_url": "https://github.com/splunk-soar-connectors/okta", "extra_urls": [ "https://github.com/splunk-soar-connectors/azuread" ], "read": "2026-11-03" }, "id_revoke_sessions": { "status": "native", "targets": [ "Okta: clear user sessions", "Microsoft Entra ID (Azure AD app): disable tokens" ], "docs_url": "https://github.com/splunk-soar-connectors/okta", "extra_urls": [ "https://github.com/splunk-soar-connectors/azuread" ], "read": "2026-11-03" }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://github.com/splunk-soar-connectors/okta", "read": "2026-11-03", "note": "Okta app lists send push notification but no factor reset; Entra app lists no authentication method actions." }, "id_remove_group": { "status": "native", "targets": [ "Okta: remove group user, unassign role", "Microsoft Entra ID (Azure AD app): remove user", "AWS IAM: remove user (from group)" ], "docs_url": "https://github.com/splunk-soar-connectors/okta", "extra_urls": [ "https://github.com/splunk-soar-connectors/azuread", "https://github.com/splunk-soar-connectors/awsiam" ], "read": "2026-11-03" }, "em_delete_msg": { "status": "native", "targets": [ "Office 365 (Splunk): delete email", "Office 365 (MS Graph): delete email" ], "docs_url": "https://github.com/splunk-soar-connectors/office365", "extra_urls": [ "https://github.com/splunk-soar-connectors/msgraphforoffice365" ], "read": "2026-11-03", "note": "Per-mailbox delete; no cross-mailbox purge action listed." }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://github.com/splunk-soar-connectors/office365", "read": "2026-11-03", "note": "Apps list move email and copy email to a folder, not an admin quarantine." }, "em_block_sender": { "status": "native", "targets": [ "Office 365: block sender", "Mimecast: blocklist sender" ], "docs_url": "https://github.com/splunk-soar-connectors/office365", "extra_urls": [ "https://github.com/splunk-soar-connectors/mimecast" ], "read": "2026-11-03" }, "em_url_exemption": { "status": "native", "targets": [ "Mimecast: unallowlist url" ], "docs_url": "https://github.com/splunk-soar-connectors/mimecast", "read": "2026-11-03" }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://github.com/splunk-soar-connectors/mimecast", "read": "2026-11-03", "note": "Mimecast app has no release or hold action." }, "cl_disable_iam": { "status": "native", "targets": [ "AWS IAM: disable user" ], "docs_url": "https://github.com/splunk-soar-connectors/awsiam", "read": "2026-11-03", "note": "User-level disable; no access-key disable action listed." }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://github.com/splunk-soar-connectors/awsiam", "read": "2026-11-03", "note": "AWS Security Token Service app lists assume role only." }, "cl_isolate_instance": { "status": "native", "targets": [ "AWS EC2: stop instance, detach instance", "Microsoft Azure Compute: stop vm, deallocate vm" ], "docs_url": "https://github.com/splunk-soar-connectors/awsec2", "extra_urls": [ "https://github.com/splunk-soar-connectors/microsoftazurecompute" ], "read": "2026-11-03" }, "cl_change_sg": { "status": "native", "targets": [ "AWS EC2: create security group, delete security group, add acl, remove acl", "Microsoft Azure Compute: add network group" ], "docs_url": "https://github.com/splunk-soar-connectors/awsec2", "extra_urls": [ "https://github.com/splunk-soar-connectors/microsoftazurecompute" ], "read": "2026-11-03", "note": "No action edits individual security group rules." }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://github.com/splunk-soar-connectors/azuread", "read": "2026-11-03", "note": "No consent or application grant action in the Entra or Okta apps." }, "nw_block_fw": { "status": "native", "targets": [ "Palo Alto Networks Panorama: block ip", "Fortinet FortiGate: block ip" ], "docs_url": "https://github.com/splunk-soar-connectors/panorama", "extra_urls": [ "https://github.com/splunk-soar-connectors/fortigate" ], "read": "2026-11-03" }, "nw_block_proxy_dns": { "status": "native", "targets": [ "Zscaler: block url, block ip", "Cisco Umbrella: block domain" ], "docs_url": "https://github.com/splunk-soar-connectors/zscaler", "extra_urls": [ "https://github.com/splunk-soar-connectors/ciscoumbrella" ], "read": "2026-11-03" }, "nw_nac": { "status": "native", "targets": [ "Cisco ISE: apply policy (ANC quarantine), terminate session" ], "docs_url": "https://github.com/splunk-soar-connectors/ciscoise", "read": "2026-11-03", "note": "README states quarantine device actions are replaced by apply policy and clear policy." }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://github.com/splunk-soar-connectors/darktrace", "read": "2026-11-03", "note": "Darktrace app (Darktrace-published) lists post tag, not a threat list." } } }, { "slug": "swimlane", "name": "Swimlane (Turbine)", "ranked": true, "counts": { "native": 18, "partner": 0, "custom": 0, "not_documented": 7 }, "coverage_share_pct": 72, "read": "2026-11-03", "cells": { "edr_isolate": { "status": "native", "targets": [ "CrowdStrike Falcon V2: take action on host (containment)", "Microsoft Defender: Isolate", "Palo Alto Cortex XDR: Isolate Endpoints" ], "docs_url": "https://docs.swimlane.com/connectors/crowdstrike-falcon-v2", "extra_urls": [ "https://docs.swimlane.com/connectors/microsoft-defender", "https://docs.swimlane.com/connectors/palo-alto-networks-cortex-xdr" ], "read": "2026-11-03" }, "edr_release": { "status": "native", "targets": [ "CrowdStrike Falcon V2: Lift Contained Endpoint", "Microsoft Defender: Unisolate" ], "docs_url": "https://docs.swimlane.com/connectors/crowdstrike-falcon-v2", "extra_urls": [ "https://docs.swimlane.com/connectors/microsoft-defender" ], "read": "2026-11-03" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://docs.swimlane.com/connectors/crowdstrike-falcon-v2", "read": "2026-11-03", "note": "CrowdStrike connector lists Get Process Details only. Real Time Response commands can run a kill command but no named kill action is documented." }, "edr_quarantine_file": { "status": "native", "targets": [ "Microsoft Defender: Stop and Quarantine" ], "docs_url": "https://docs.swimlane.com/connectors/microsoft-defender", "read": "2026-11-03" }, "edr_run_script": { "status": "native", "targets": [ "CrowdStrike Falcon V2: Execute RTR Command, Execute Admin RTR Command" ], "docs_url": "https://docs.swimlane.com/connectors/crowdstrike-falcon-v2", "read": "2026-11-03" }, "edr_block_hash": { "status": "native", "targets": [ "Palo Alto Cortex XDR: Blacklist Files", "CrowdStrike Falcon V2: Create Indicator", "SentinelOne: blocklist items" ], "docs_url": "https://docs.swimlane.com/connectors/palo-alto-networks-cortex-xdr", "extra_urls": [ "https://docs.swimlane.com/connectors/crowdstrike-falcon-v2", "https://docs.swimlane.com/connectors/sentinelone" ], "read": "2026-11-03" }, "id_disable_user": { "status": "native", "targets": [ "Okta Identity Management: Deactivate User, Suspend User" ], "docs_url": "https://docs.swimlane.com/connectors/okta-identity-management", "read": "2026-11-03" }, "id_pw_reset": { "status": "native", "targets": [ "Okta Identity Management: Force User Password Reset", "Microsoft Graph IAM: reset password" ], "docs_url": "https://docs.swimlane.com/connectors/okta-identity-management", "extra_urls": [ "https://docs.swimlane.com/connectors/microsoft-graph-api-identity-and-access-management" ], "read": "2026-11-03" }, "id_revoke_sessions": { "status": "native", "targets": [ "Okta Identity Management: Clear User Session", "Microsoft Graph IAM: revokeSignInSessions" ], "docs_url": "https://docs.swimlane.com/connectors/okta-identity-management", "extra_urls": [ "https://docs.swimlane.com/connectors/microsoft-graph-api-identity-and-access-management" ], "read": "2026-11-03" }, "id_mfa_reenroll": { "status": "native", "targets": [ "Microsoft Graph IAM: Delete Microsoft Authenticator Auth Method, Delete Phone Authentication Method, Delete FIDO2 Authentication Method" ], "docs_url": "https://docs.swimlane.com/connectors/microsoft-graph-api-identity-and-access-management", "read": "2026-11-03" }, "id_remove_group": { "status": "native", "targets": [ "Okta Identity Management: remove user from group" ], "docs_url": "https://docs.swimlane.com/connectors/okta-identity-management", "read": "2026-11-03" }, "em_delete_msg": { "status": "native", "targets": [ "Microsoft Exchange: Delete from All Mailboxes", "Microsoft Graph Mail: Delete Email" ], "docs_url": "https://docs.swimlane.com/connectors/microsoft-exchange", "extra_urls": [ "https://docs.swimlane.com/connectors/microsoft-graph-api-mail-and-communication" ], "read": "2026-11-03" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://docs.swimlane.com/connectors/microsoft-exchange", "read": "2026-11-03", "note": "Exchange connector lists Move Email to Folder, not an admin quarantine." }, "em_block_sender": { "status": "native", "targets": [ "Mimecast Security: Create Block Sender Policy" ], "docs_url": "https://docs.swimlane.com/connectors/mimecast-security", "read": "2026-11-03" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://docs.swimlane.com/connectors/mimecast-security", "read": "2026-11-03", "note": "Mimecast connector lists Create Managed URL, no removal." }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://docs.swimlane.com/connectors/mimecast-security", "read": "2026-11-03", "note": "Mimecast connector lists details of messages on hold, no release action." }, "cl_disable_iam": { "status": "native", "targets": [ "Amazon AWS IAM: Disable Access Key" ], "docs_url": "https://docs.swimlane.com/connectors/amazon-aws-iam", "read": "2026-11-03" }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://docs.swimlane.com/connectors/amazon-aws-iam", "read": "2026-11-03" }, "cl_isolate_instance": { "status": "native", "targets": [ "Amazon AWS EC2: stop instance", "Microsoft Azure Virtual Machines: Power Off Virtual Machines" ], "docs_url": "https://docs.swimlane.com/connectors/amazon-aws-ec2", "extra_urls": [ "https://docs.swimlane.com/connectors/microsoft-azure-virtual-machines" ], "read": "2026-11-03" }, "cl_change_sg": { "status": "native", "targets": [ "Amazon AWS EC2: security group actions", "Microsoft Azure Virtual Network: network security group actions" ], "docs_url": "https://docs.swimlane.com/connectors/amazon-aws-ec2", "extra_urls": [ "https://docs.swimlane.com/connectors/microsoft-azure-virtual-network" ], "read": "2026-11-03" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://docs.swimlane.com/connectors/microsoft-graph-api-identity-and-access-management", "read": "2026-11-03" }, "nw_block_fw": { "status": "native", "targets": [ "Palo Alto Networks PAN-OS: Create a Security Policy Rule", "Fortinet FortiGate: Create Policy", "Zscaler Security: Add Firewall Filtering Policy Rule" ], "docs_url": "https://docs.swimlane.com/connectors/palo-alto-networks-pan-os", "extra_urls": [ "https://docs.swimlane.com/connectors/fortinet-fortigate", "https://docs.swimlane.com/connectors/zscaler-security" ], "read": "2026-11-03" }, "nw_block_proxy_dns": { "status": "native", "targets": [ "Zscaler Security: Block URLs", "Cisco Umbrella: Add Destinations to Destination List" ], "docs_url": "https://docs.swimlane.com/connectors/zscaler-security", "extra_urls": [ "https://docs.swimlane.com/connectors/cisco-umbrella-api" ], "read": "2026-11-03" }, "nw_nac": { "status": "native", "targets": [ "Cisco Identity Services Engine: Change of Authorization Session Disconnect" ], "docs_url": "https://docs.swimlane.com/connectors/cisco-identity-services-engine", "read": "2026-11-03" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://docs.swimlane.com/connectors/vectra-cognito-v2", "read": "2026-11-03", "note": "Vectra connector lists Add Tags; Darktrace connector lists Execute Advanced Search." } } }, { "slug": "torq", "name": "Torq", "ranked": true, "counts": { "native": 13, "partner": 0, "custom": 0, "not_documented": 12 }, "coverage_share_pct": 52, "read": "2026-11-03", "cells": { "edr_isolate": { "status": "native", "targets": [ "CrowdStrike: Contain Host step", "Microsoft Defender for Endpoint: Isolate or Unisolate device workflow template" ], "docs_url": "https://kb.torq.io/en/articles/9138382-crowdstrike", "extra_urls": [ "https://kb.torq.io/en/articles/9350231-workflow-template-isolate-or-unisolate-device-on-microsoft-defender-for-endpoint" ], "read": "2026-11-03" }, "edr_release": { "status": "native", "targets": [ "CrowdStrike: manage containment on a device workflow template", "Microsoft Defender for Endpoint: Isolate or Unisolate device workflow template" ], "docs_url": "https://kb.torq.io/en/articles/13303335-workflow-template-manage-containment-on-a-device-in-crowdstrike", "extra_urls": [ "https://kb.torq.io/en/articles/9350231-workflow-template-isolate-or-unisolate-device-on-microsoft-defender-for-endpoint" ], "read": "2026-11-03" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/9138382-crowdstrike", "read": "2026-11-03", "note": "CrowdStrike article lists 5 of 60 steps by name; no kill step is among them." }, "edr_quarantine_file": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/9973890-microsoft-defender-for-endpoint", "read": "2026-11-03" }, "edr_run_script": { "status": "native", "targets": [ "Microsoft Defender for Endpoint: Execute Live Response step", "SentinelOne: run remote script workflow templates" ], "docs_url": "https://kb.torq.io/en/articles/9973890-microsoft-defender-for-endpoint", "extra_urls": [ "https://kb.torq.io/en/articles/12950712-workflow-template-run-remote-script-on-devices-with-sentinelone-agent" ], "read": "2026-11-03" }, "edr_block_hash": { "status": "native", "targets": [ "SentinelOne: Blacklist SHA1 Hashes workflow template", "Microsoft Defender for Endpoint: Add or Update Indicator step", "CrowdStrike: Create Indicator step" ], "docs_url": "https://kb.torq.io/en/articles/9350183-workflow-template-blacklist-sha1-hashes-on-multiple-sentinelone-sites", "extra_urls": [ "https://kb.torq.io/en/articles/9973890-microsoft-defender-for-endpoint", "https://kb.torq.io/en/articles/9138382-crowdstrike" ], "read": "2026-11-03" }, "id_disable_user": { "status": "native", "targets": [ "Okta: Disable and Contain a Specific Compromised User template", "Microsoft Entra ID: Disable and Contain a Specific User template", "Google Cloud Identity: Disable a Specific User template", "Active Directory: Disable Account step" ], "docs_url": "https://kb.torq.io/en/articles/9350135-workflow-template-disable-and-contain-a-specific-compromised-user-in-okta", "extra_urls": [ "https://kb.torq.io/en/articles/9350019-workflow-template-disable-and-contain-a-specific-user-in-entra-id-ex-azure-ad", "https://kb.torq.io/en/articles/9350025-workflow-template-disable-a-specific-user-in-google-cloud-identity", "https://kb.torq.io/en/articles/10338677-microsoft-active-directory" ], "read": "2026-11-03" }, "id_pw_reset": { "status": "native", "targets": [ "Microsoft Entra ID: Reset MFA Methods and Password template", "Okta: compromised user template (password reset)" ], "docs_url": "https://kb.torq.io/en/articles/9350142-workflow-template-reset-entra-id-ex-azure-ad-mfa-methods-and-password-on-a-user", "extra_urls": [ "https://kb.torq.io/en/articles/9350135-workflow-template-disable-and-contain-a-specific-compromised-user-in-okta" ], "read": "2026-11-03" }, "id_revoke_sessions": { "status": "native", "targets": [ "Okta: Clear Okta sessions for specific users template" ], "docs_url": "https://kb.torq.io/en/articles/9350024-workflow-template-clear-okta-sessions-for-specific-users-via-slack", "read": "2026-11-03" }, "id_mfa_reenroll": { "status": "native", "targets": [ "Microsoft Entra ID: Reset MFA Methods and Password template", "Okta: reset factors (compromised user template)" ], "docs_url": "https://kb.torq.io/en/articles/9350142-workflow-template-reset-entra-id-ex-azure-ad-mfa-methods-and-password-on-a-user", "extra_urls": [ "https://kb.torq.io/en/articles/9350135-workflow-template-disable-and-contain-a-specific-compromised-user-in-okta" ], "read": "2026-11-03" }, "id_remove_group": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/9139783-okta", "read": "2026-11-03", "note": "Okta and Active Directory articles list Add User to Group among the named steps; no remove step is named." }, "em_delete_msg": { "status": "native", "targets": [ "Microsoft 365: Delete Message step" ], "docs_url": "https://kb.torq.io/en/articles/10287213-microsoft-365", "read": "2026-11-03", "note": "Per-mailbox step." }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/10183856-proofpoint", "read": "2026-11-03" }, "em_block_sender": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/10183856-proofpoint", "read": "2026-11-03", "note": "Proofpoint article lists decode URLs, campaign and threat forensics." }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/10183856-proofpoint", "read": "2026-11-03" }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/10183856-proofpoint", "read": "2026-11-03" }, "cl_disable_iam": { "status": "native", "targets": [ "AWS IAM: Delete an IAM User Account template", "Google Cloud Identity: Disable a Specific User template" ], "docs_url": "https://kb.torq.io/en/articles/9350170-workflow-template-delete-an-iam-user-account", "extra_urls": [ "https://kb.torq.io/en/articles/9350025-workflow-template-disable-a-specific-user-in-google-cloud-identity" ], "read": "2026-11-03", "note": "AWS template deletes the user; it does not disable it." }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/9138309-amazon-web-services-aws", "read": "2026-11-03" }, "cl_isolate_instance": { "status": "native", "targets": [ "AWS EC2: Isolate an AWS EC2 Instance by using tags template" ], "docs_url": "https://kb.torq.io/en/articles/9350099-workflow-template-isolate-an-aws-ec2-instance-by-using-tags", "read": "2026-11-03" }, "cl_change_sg": { "status": "native", "targets": [ "AWS: Handle AWS Security Group with Open SSH Access template" ], "docs_url": "https://kb.torq.io/en/articles/9350033-workflow-template-handle-aws-security-group-with-open-ssh-access-on-orca-alert", "read": "2026-11-03" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/10287213-microsoft-365", "read": "2026-11-03" }, "nw_block_fw": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/9138366-check-point-management", "read": "2026-11-03", "note": "Check Point Management article names no block action." }, "nw_block_proxy_dns": { "status": "native", "targets": [ "Zscaler: Add and Remove URLs from the Global Blacklist template", "Cloudflare Zero Trust: Add Phishing Domain template" ], "docs_url": "https://kb.torq.io/en/articles/9350095-workflow-template-add-and-remove-urls-from-the-global-blacklist-zscaler", "extra_urls": [ "https://kb.torq.io/en/articles/9350052-workflow-template-add-phishing-domain-to-cloudflare-zerotrust-intsights" ], "read": "2026-11-03" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/9138366-check-point-management", "read": "2026-11-03" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://kb.torq.io/en/articles/9138366-check-point-management", "read": "2026-11-03" } } }, { "slug": "tines", "name": "Tines", "ranked": true, "counts": { "native": 22, "partner": 0, "custom": 0, "not_documented": 3 }, "coverage_share_pct": 88, "read": "2026-11-03", "cells": { "edr_isolate": { "status": "native", "targets": [ "CrowdStrike: Take action on hosts template (contain)", "Microsoft Defender for Endpoint: Isolate machine template", "Cortex XDR: Create isolation for single endpoint template", "Cisco Secure Endpoint: Append Isolation on Computer template" ], "docs_url": "https://www.tines.com/stories/templates/crowdstrike/", "extra_urls": [ "https://www.tines.com/stories/templates/microsoft-defender-for-endpoint/", "https://www.tines.com/stories/templates/palo-alto-networks/", "https://www.tines.com/stories/templates/cisco/", "https://www.tines.com/library/stories/87621/" ], "read": "2026-11-03" }, "edr_release": { "status": "native", "targets": [ "Microsoft Defender for Endpoint: Release machine from isolation template", "CrowdStrike: Take action on hosts template (lift containment)", "Contain or release hosts in CrowdStrike from Jira story" ], "docs_url": "https://www.tines.com/stories/templates/microsoft-defender-for-endpoint/", "extra_urls": [ "https://www.tines.com/stories/templates/crowdstrike/" ], "read": "2026-11-03" }, "edr_kill": { "status": "native", "targets": [ "CrowdStrike: Kill an active process in CrowdStrike story" ], "docs_url": "https://www.tines.com/stories/templates/crowdstrike/", "extra_urls": [ "https://www.tines.com/library/stories/1164461/kill-an-active-process-in-crowdstrike/" ], "read": "2026-11-03" }, "edr_quarantine_file": { "status": "native", "targets": [ "Microsoft Defender for Endpoint: Stop and quarantine file template" ], "docs_url": "https://www.tines.com/stories/templates/microsoft-defender-for-endpoint/", "read": "2026-11-03" }, "edr_run_script": { "status": "native", "targets": [ "CrowdStrike: Execute RTR administrator command, active responder command, read only command templates", "SentinelOne: Trigger Remote Script templates (Linux)" ], "docs_url": "https://www.tines.com/stories/templates/crowdstrike/", "extra_urls": [ "https://www.tines.com/stories/templates/sentinelone/" ], "read": "2026-11-03" }, "edr_block_hash": { "status": "native", "targets": [ "SentinelOne: Ban a Hash, Block a hash templates", "Microsoft Defender for Endpoint: indicator templates", "CrowdStrike: Upload a single IOC template" ], "docs_url": "https://www.tines.com/stories/templates/sentinelone/", "extra_urls": [ "https://www.tines.com/stories/templates/microsoft-defender-for-endpoint/", "https://www.tines.com/stories/templates/crowdstrike/" ], "read": "2026-11-03" }, "id_disable_user": { "status": "native", "targets": [ "Okta: Deactivate a User template", "Microsoft Entra ID: Disable User template", "Google Workspace: Suspend User template" ], "docs_url": "https://www.tines.com/stories/templates/okta/", "extra_urls": [ "https://www.tines.com/stories/templates/microsoft-graph/", "https://www.tines.com/stories/templates/google-admin-console/" ], "read": "2026-11-03" }, "id_pw_reset": { "status": "native", "targets": [ "Okta: Reset Password, Expire the password templates", "Microsoft Entra ID: Reset Users Password template" ], "docs_url": "https://www.tines.com/stories/templates/okta/", "extra_urls": [ "https://www.tines.com/stories/templates/microsoft-graph/" ], "read": "2026-11-03" }, "id_revoke_sessions": { "status": "native", "targets": [ "Microsoft Graph: Revoke user's sign in sessions template", "Okta: End a current user session template" ], "docs_url": "https://www.tines.com/stories/templates/microsoft-graph/", "extra_urls": [ "https://www.tines.com/stories/templates/okta/" ], "read": "2026-11-03" }, "id_mfa_reenroll": { "status": "native", "targets": [ "Okta: Reset all Factors template", "AWS IAM: Delete MFA Device template" ], "docs_url": "https://www.tines.com/stories/templates/okta/", "extra_urls": [ "https://www.tines.com/stories/templates/aws-iam/" ], "read": "2026-11-03" }, "id_remove_group": { "status": "native", "targets": [ "Okta: Remove a User from a group template", "Google Workspace: Delete Member from Groups template" ], "docs_url": "https://www.tines.com/stories/templates/okta/", "extra_urls": [ "https://www.tines.com/stories/templates/google-admin-console/" ], "read": "2026-11-03" }, "em_delete_msg": { "status": "native", "targets": [ "Gmail: Batch delete emails, Delete an email templates", "Microsoft Graph: Delete a message template", "Mimecast: Create Remediation Incident by MessageID or Hash template" ], "docs_url": "https://www.tines.com/stories/templates/gmail/", "extra_urls": [ "https://www.tines.com/stories/templates/microsoft-graph/", "https://www.tines.com/stories/templates/mimecast/" ], "read": "2026-11-03" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://www.tines.com/stories/templates/mimecast/", "read": "2026-11-03", "note": "Templates found delete and release quarantined mail, not move a delivered message into quarantine." }, "em_block_sender": { "status": "native", "targets": [ "Mimecast: Create Blocked Senders Policy, Permit or Block Sender templates", "Cisco Secure Email: Append Sender Blocklist Entries template" ], "docs_url": "https://www.tines.com/stories/templates/mimecast/", "extra_urls": [ "https://www.tines.com/stories/templates/cisco/" ], "read": "2026-11-03" }, "em_url_exemption": { "status": "native", "targets": [ "Mimecast: Delete Managed URL template" ], "docs_url": "https://www.tines.com/stories/templates/mimecast/", "read": "2026-11-03" }, "em_release_quarantine": { "status": "native", "targets": [ "Proofpoint Protection Server: Release Quarantined Message template", "Cisco Secure Email: Trigger Release from Quarantine template", "Mimecast: Hold Release template" ], "docs_url": "https://www.tines.com/stories/templates/proofpoint/", "extra_urls": [ "https://www.tines.com/stories/templates/cisco/", "https://www.tines.com/stories/templates/mimecast/" ], "read": "2026-11-03" }, "cl_disable_iam": { "status": "native", "targets": [ "AWS IAM: Delete Access Key, Attach AWS Deny All Policy templates" ], "docs_url": "https://www.tines.com/stories/templates/aws-iam/", "read": "2026-11-03", "note": "Delete key and deny-all policy rather than a disable flag." }, "cl_revoke_session": { "status": "native", "targets": [ "AWS IAM: Revoke AWS IAM Role Sessions template" ], "docs_url": "https://www.tines.com/stories/templates/aws-iam/", "read": "2026-11-03" }, "cl_isolate_instance": { "status": "native", "targets": [ "AWS: Stop AWS EC2 Instance template" ], "docs_url": "https://www.tines.com/stories/templates/aws/", "read": "2026-11-03" }, "cl_change_sg": { "status": "native", "targets": [ "AWS: Revoke AWS EC2 Security Group Rules, Set AWS EC2 Security Group templates" ], "docs_url": "https://www.tines.com/stories/templates/aws/", "read": "2026-11-03" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://www.tines.com/stories/templates/okta/", "read": "2026-11-03", "note": "577 Okta templates and 383 Microsoft Graph templates were filtered; none revokes an OAuth consent grant (Okta has Grant consent to scope only)." }, "nw_block_fw": { "status": "native", "targets": [ "AWS WAF: Update an IPSet template" ], "docs_url": "https://www.tines.com/stories/templates/aws/", "read": "2026-11-03", "note": "AWS WAF IP set only. No Palo Alto, Fortinet or Check Point NGFW block template was found (Palo Alto page lists Cortex XDR, Xpanse and GlobalProtect session end)." }, "nw_block_proxy_dns": { "status": "native", "targets": [ "Cisco Umbrella: Block Domain template", "Zscaler: Add Black-Listed URLs template" ], "docs_url": "https://www.tines.com/stories/templates/cisco/", "extra_urls": [ "https://www.tines.com/stories/templates/zscaler/" ], "read": "2026-11-03" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://www.tines.com/stories/templates/cisco/", "read": "2026-11-03", "note": "No Cisco ISE template matched the response filters used." }, "nw_ndr_list": { "status": "native", "targets": [ "Cisco Secure Cloud Analytics: Create Watchlisted Domain template" ], "docs_url": "https://www.tines.com/stories/templates/cisco/", "read": "2026-11-03" } } }, { "slug": "d3-security", "name": "D3 Security", "ranked": true, "counts": { "native": 19, "partner": 0, "custom": 0, "not_documented": 6 }, "coverage_share_pct": 76, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "native", "targets": [ "CrowdStrike: Quarantine Host (Isolate Host)", "Microsoft Defender for Endpoint: Quarantine Hosts", "Cortex XDR: Isolate Hosts", "SentinelOne: Disconnect From Network", "Carbon Black Cloud V2: Quarantine Devices" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/crowdstrike", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-defender-for-endpoint", "https://docs.d3security.com/integration-docs/morpheus-integrations/cortex-xdr-client-facing-document", "https://docs.d3security.com/integration-docs/morpheus-integrations/sentinelone", "https://docs.d3security.com/integration-docs/morpheus-integrations/carbon-black-cloud-v2" ], "read": "2026-11-04" }, "edr_release": { "status": "native", "targets": [ "CrowdStrike: Unquarantine Endpoint", "Microsoft Defender for Endpoint: Unquarantine Hosts", "Cortex XDR: Unisolate Hosts", "Carbon Black Cloud V2: Unquarantine Devices" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/crowdstrike", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-defender-for-endpoint", "https://docs.d3security.com/integration-docs/morpheus-integrations/cortex-xdr-client-facing-document" ], "read": "2026-11-04" }, "edr_kill": { "status": "native", "targets": [ "SentinelOne: Kill Processes" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/sentinelone", "read": "2026-11-04" }, "edr_quarantine_file": { "status": "native", "targets": [ "CrowdStrike: Quarantine Files", "Microsoft Defender for Endpoint: Quarantine Files", "SentinelOne: Quarantine Files" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/crowdstrike", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-defender-for-endpoint", "https://docs.d3security.com/integration-docs/morpheus-integrations/sentinelone" ], "read": "2026-11-04" }, "edr_run_script": { "status": "native", "targets": [ "Cortex XDR: Run Script", "Microsoft Defender for Endpoint: Run Live Response Commands", "CrowdStrike: Execute Command On Single Endpoint" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/cortex-xdr-client-facing-document", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-defender-for-endpoint", "https://docs.d3security.com/integration-docs/morpheus-integrations/crowdstrike" ], "read": "2026-11-04" }, "edr_block_hash": { "status": "native", "targets": [ "Carbon Black Cloud V2: Block Hashes", "SentinelOne: Block Hash", "Proofpoint Threat Response: Block Hashes" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/carbon-black-cloud-v2", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/sentinelone", "https://docs.d3security.com/integration-docs/morpheus-integrations/proofpoint-threat-response" ], "read": "2026-11-04" }, "id_disable_user": { "status": "native", "targets": [ "Microsoft Entra ID: Disable User", "Okta: Deactivate Users", "Cisco ISE: Disable User" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-entra-id-azure-active-directory", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/okta", "https://docs.d3security.com/integration-docs/morpheus-integrations/cisco-identity-services-engine" ], "read": "2026-11-04" }, "id_pw_reset": { "status": "native", "targets": [ "Okta: Reset User Passwords", "Microsoft Entra ID: Reset Password" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/okta", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-entra-id-azure-active-directory" ], "read": "2026-11-04" }, "id_revoke_sessions": { "status": "native", "targets": [ "Okta: Revoke User Sessions", "Microsoft Entra ID: Revoke SignIn Sessions" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/okta", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-entra-id-azure-active-directory" ], "read": "2026-11-04" }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/okta", "read": "2026-11-04", "note": "Okta page mentions MFA reset only in an admin role description. Entra page lists no authentication method command." }, "id_remove_group": { "status": "native", "targets": [ "Microsoft Entra ID: Remove Group Members" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-entra-id-azure-active-directory", "read": "2026-11-04" }, "em_delete_msg": { "status": "native", "targets": [ "Microsoft Exchange Server: Remove Emails", "Office 365: Delete Email Message", "Gmail V2: Delete Emails", "Microsoft Purview eDiscovery V2: Purge Emails (cross-mailbox)", "Microsoft 365 Defender Email and Collaboration: Delete Search Result Emails" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-purview-ediscovery-v2", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-exchange-server", "https://docs.d3security.com/integration-docs/morpheus-integrations/office-365", "https://docs.d3security.com/integration-docs/morpheus-integrations/gmail-v2", "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-365-defender-email-collaboration" ], "read": "2026-11-04" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-365-defender-email-collaboration", "read": "2026-11-04", "note": "Page documents Quarantine Messages as a retrieval command and Block Emails (Exchange Server) as a move; not a quarantine action on a delivered message." }, "em_block_sender": { "status": "native", "targets": [ "Microsoft 365 Defender Email and Collaboration: Block Senders", "Mimecast: Block Sender", "Cisco Email Security: Block Email Addresses" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-365-defender-email-collaboration", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/mimecast", "https://docs.d3security.com/integration-docs/morpheus-integrations/cisco-email-security" ], "read": "2026-11-04" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/mimecast", "read": "2026-11-04", "note": "Mimecast page lists Block Sender and Release Message; M365 Defender lists Remove Items From Blocklist, which is not a URL rewrite exemption." }, "em_release_quarantine": { "status": "native", "targets": [ "Microsoft 365 Defender Email and Collaboration: Release Quarantine Messages", "Mimecast: Release Message", "Proofpoint Protection Server: Release Quarantine Messages" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-365-defender-email-collaboration", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/mimecast", "https://docs.d3security.com/integration-docs/morpheus-integrations/proofpoint-protection-server" ], "read": "2026-11-04" }, "cl_disable_iam": { "status": "not documented", "targets": [], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/aws-iam", "read": "2026-11-04", "note": "AWS IAM page documents Attach Role Policy and Detach Role Policy plus read commands; no user or access key disable." }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/aws-iam", "read": "2026-11-04" }, "cl_isolate_instance": { "status": "native", "targets": [ "AWS EC2: Quarantine EC2 Instances" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/aws-ec2", "read": "2026-11-04" }, "cl_change_sg": { "status": "native", "targets": [ "Azure Network Security Groups: Block IPs", "AWS EC2: Block IPs By VPC ACL" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/azure-network-security-groups", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/aws-ec2" ], "read": "2026-11-04" }, "cl_revoke_oauth": { "status": "native", "targets": [ "Microsoft Entra ID: Delete OAuth2 Permission Grants" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/microsoft-entra-id-azure-active-directory", "read": "2026-11-04" }, "nw_block_fw": { "status": "native", "targets": [ "Palo Alto Networks PAN-OS: Block Domains By Adding To Address Group", "Fortinet FortiGate: Remove IPs From Address Group and ban commands" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/palo-alto-networks-pan-os", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/fortigate" ], "read": "2026-11-04" }, "nw_block_proxy_dns": { "status": "native", "targets": [ "Zscaler: Blacklist URLs", "Cisco Umbrella Enforcement: Delete Enforced Domains and enforcement commands" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/zscaler", "extra_urls": [ "https://docs.d3security.com/integration-docs/morpheus-integrations/cisco-umbrella-enforcement" ], "read": "2026-11-04" }, "nw_nac": { "status": "native", "targets": [ "Cisco ISE: Assign Endpoints to Blacklist" ], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/cisco-identity-services-engine", "read": "2026-11-04" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://docs.d3security.com/integration-docs/morpheus-integrations/darktrace", "read": "2026-11-04", "note": "Darktrace page documents Block Matching Connections and Quarantine device enforcement actions, which act on devices, not a threat list." } } }, { "slug": "google-secops", "name": "Google Security Operations", "ranked": true, "counts": { "native": 19, "partner": 0, "custom": 0, "not_documented": 6 }, "coverage_share_pct": 76, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "native", "targets": [ "CrowdStrike Falcon: Contain Endpoint", "Microsoft Defender ATP: Isolate Machine", "Palo Alto Cortex XDR: Isolate Endpoint", "Carbon Black Response: Isolate Host", "Cisco AMP: Isolate Machine" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/crowdstrike-falcon", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-defender-atp", "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/palo-alto-cortex-xdr", "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/carbon-black-response", "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/cisco-amp" ], "read": "2026-11-04" }, "edr_release": { "status": "native", "targets": [ "CrowdStrike Falcon: Lift Contained Endpoint", "Microsoft Defender ATP: Unisolate Machine", "Palo Alto Cortex XDR: Unisolate Endpoint", "Carbon Black Response: Unisolate Host" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/crowdstrike-falcon", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-defender-atp", "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/palo-alto-cortex-xdr", "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/carbon-black-response" ], "read": "2026-11-04" }, "edr_kill": { "status": "native", "targets": [ "Carbon Black Response: Kill Process" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/carbon-black-response", "read": "2026-11-04" }, "edr_quarantine_file": { "status": "native", "targets": [ "Microsoft Defender ATP: Stop and Quarantine a File on Specific Machine" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-defender-atp", "read": "2026-11-04" }, "edr_run_script": { "status": "native", "targets": [ "CrowdStrike Falcon: Run Script, Execute Command", "Microsoft Defender ATP: Execute Live Response Command" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/crowdstrike-falcon", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-defender-atp" ], "read": "2026-11-04" }, "edr_block_hash": { "status": "native", "targets": [ "Palo Alto Cortex XDR: Add Hashes to Block List", "Carbon Black Response: Block Hash", "VMware Carbon Black Cloud: Create a Reputation Override for SHA-256 Hash" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/palo-alto-cortex-xdr", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/carbon-black-response", "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/vmware-carbon-black-cloud" ], "read": "2026-11-04" }, "id_disable_user": { "status": "native", "targets": [ "Okta: Disable User", "Azure AD: Disable Account" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/okta", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/azure-ad" ], "read": "2026-11-04" }, "id_pw_reset": { "status": "native", "targets": [ "Okta: Reset Password", "Azure AD: Reset User Password" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/okta", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/azure-ad" ], "read": "2026-11-04" }, "id_revoke_sessions": { "status": "native", "targets": [ "Okta: Clear Okta User Session", "Azure AD: Revoke User Session", "Google Workspace: Revoke User Sessions", "Microsoft Graph Security: Kill User Session" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/okta", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/azure-ad", "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-workspace", "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-graph-security" ], "read": "2026-11-04" }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/okta", "read": "2026-11-04", "note": "Okta and Azure AD pages list no factor or authentication method reset." }, "id_remove_group": { "status": "native", "targets": [ "Azure AD: Remove User from the Group", "Okta: Unassign Role", "AWS IAM: Remove a User from a Group" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/azure-ad", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/okta", "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/aws-iam" ], "read": "2026-11-04" }, "em_delete_msg": { "status": "native", "targets": [ "Exchange: Delete Mail", "Microsoft Graph Mail: Delete Email", "Gmail: Delete Email" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/exchange", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-graph-mail", "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/gmail" ], "read": "2026-11-04" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/exchange", "read": "2026-11-04" }, "em_block_sender": { "status": "native", "targets": [ "Microsoft Graph Mail: Block Sender, Block Domain", "Mimecast: Block Sender", "Exchange: Block Sender by Message ID" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-graph-mail", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/mimecast", "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/exchange" ], "read": "2026-11-04" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/mimecast", "read": "2026-11-04", "note": "Mimecast page lists Permit Sender, Block Sender, Release Message and Create Block Sender Policy." }, "em_release_quarantine": { "status": "native", "targets": [ "Mimecast: Release Message" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/mimecast", "read": "2026-11-04" }, "cl_disable_iam": { "status": "native", "targets": [ "Google Cloud IAM: Disable Service Account", "AWS IAM: Disable User Access" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-cloud-iam", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/aws-iam" ], "read": "2026-11-04" }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/aws-iam", "read": "2026-11-04" }, "cl_isolate_instance": { "status": "native", "targets": [ "AWS EC2: Stop Instance, Terminate Instance", "Google Cloud Compute: Stop Instance" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/aws-elastic-compute-cloud-ec2", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-cloud-compute" ], "read": "2026-11-04" }, "cl_change_sg": { "status": "native", "targets": [ "AWS EC2: Revoke Security Group Ingress, Authorize Security Group Ingress", "Google Cloud Compute: Update Firewall Rule, Add IP To Firewall Rule" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/aws-elastic-compute-cloud-ec2", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-cloud-compute" ], "read": "2026-11-04" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/azure-ad", "read": "2026-11-04" }, "nw_block_fw": { "status": "native", "targets": [ "Palo Alto Panorama: Block IPs in Policy", "FortiGate: Add Entities To Address Group" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/palo-alto-panorama", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/fortigate" ], "read": "2026-11-04" }, "nw_block_proxy_dns": { "status": "native", "targets": [ "Zscaler: Add to Blacklist", "Cisco Umbrella: Add Domain" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/zscaler", "extra_urls": [ "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/cisco-umbrella" ], "read": "2026-11-04" }, "nw_nac": { "status": "native", "targets": [ "Cisco ISE: Quarantine Address" ], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/cisco-ise", "read": "2026-11-04" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/vectra", "read": "2026-11-04", "note": "Vectra page lists Add Tags and Remove Tags." } } }, { "slug": "microsoft-sentinel", "name": "Microsoft Sentinel", "ranked": true, "counts": { "native": 9, "partner": 0, "custom": 0, "not_documented": 16 }, "coverage_share_pct": 36, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "native", "targets": [ "Microsoft Defender for Endpoint (Logic Apps connector): Actions - Isolate machine" ], "docs_url": "https://learn.microsoft.com/en-us/connectors/wdatp/", "read": "2026-11-04" }, "edr_release": { "status": "native", "targets": [ "Microsoft Defender for Endpoint (Logic Apps connector): Actions - Unisolate machine" ], "docs_url": "https://learn.microsoft.com/en-us/connectors/wdatp/", "read": "2026-11-04" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/wdatp/", "read": "2026-11-04", "note": "Connector lists machine actions: isolate, unisolate, restrict app execution, run antivirus scan, run live response, collect investigation package." }, "edr_quarantine_file": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/wdatp/", "read": "2026-11-04", "note": "Stop and quarantine file is not among the connector's listed actions." }, "edr_run_script": { "status": "native", "targets": [ "Microsoft Defender for Endpoint (Logic Apps connector): Actions - Run live response" ], "docs_url": "https://learn.microsoft.com/en-us/connectors/wdatp/", "read": "2026-11-04" }, "edr_block_hash": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/wdatp/", "extra_urls": [ "https://learn.microsoft.com/en-us/connectors/microsoftgraphsecurity/" ], "read": "2026-11-04", "note": "Defender connector lists no indicator action; the Graph Security connector's tiIndicator actions are marked deprecated." }, "id_disable_user": { "status": "native", "targets": [ "Microsoft Entra ID: Block-AADUserOrAdmin playbook template (disables the user)" ], "docs_url": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Playbooks/Block-AADUserOrAdmin/readme.md", "read": "2026-11-04", "note": "Template in the Azure-Sentinel repository; authored by individual contributors under the Microsoft repo." }, "id_pw_reset": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/azuread/", "read": "2026-11-04", "note": "Entra ID connector lists no password reset action." }, "id_revoke_sessions": { "status": "native", "targets": [ "Microsoft Entra ID (Logic Apps connector): Refresh tokens (invalidate all refresh tokens for a user)" ], "docs_url": "https://learn.microsoft.com/en-us/connectors/azuread/", "read": "2026-11-04" }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/azuread/", "read": "2026-11-04" }, "id_remove_group": { "status": "native", "targets": [ "Microsoft Entra ID (Logic Apps connector): Remove Member From Group" ], "docs_url": "https://learn.microsoft.com/en-us/connectors/azuread/", "read": "2026-11-04" }, "em_delete_msg": { "status": "native", "targets": [ "Office 365 Outlook (Logic Apps connector): Delete email (V2)" ], "docs_url": "https://learn.microsoft.com/en-us/connectors/office365/", "read": "2026-11-04", "note": "Per-mailbox." }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/office365/", "read": "2026-11-04" }, "em_block_sender": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/office365/", "read": "2026-11-04" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/office365/", "read": "2026-11-04" }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/office365/", "read": "2026-11-04" }, "cl_disable_iam": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/azuread/", "read": "2026-11-04", "note": "No AWS or GCP IAM actions in the Logic Apps connectors read; Entra user disable is counted under identity." }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/azuread/", "read": "2026-11-04" }, "cl_isolate_instance": { "status": "native", "targets": [ "Azure VM (Logic Apps connector): Deallocate virtual machine", "Isolate-AzureVMtoNSG playbook template" ], "docs_url": "https://learn.microsoft.com/en-us/connectors/azurevm/", "extra_urls": [ "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Playbooks/Isolate-AzureVMtoNSG/readme.md" ], "read": "2026-11-04" }, "cl_change_sg": { "status": "native", "targets": [ "Isolate-AzureVMtoNSG playbook template (creates and applies a Deny All NSG)" ], "docs_url": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Playbooks/Isolate-AzureVMtoNSG/readme.md", "read": "2026-11-04" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/azuread/", "read": "2026-11-04" }, "nw_block_fw": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/azuresentinel/", "read": "2026-11-04" }, "nw_block_proxy_dns": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/azuresentinel/", "read": "2026-11-04" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/azuresentinel/", "read": "2026-11-04" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://learn.microsoft.com/en-us/connectors/azuresentinel/", "read": "2026-11-04" } } }, { "slug": "servicenow-secops", "name": "ServiceNow Security Operations", "ranked": true, "counts": { "native": 7, "partner": 0, "custom": 0, "not_documented": 18 }, "coverage_share_pct": 28, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/crowdstrike-spoke.html", "read": "2026-11-04", "note": "CrowdStrike spoke documents host and sensor look-up actions only. ServiceNow Store security operations apps were not readable." }, "edr_release": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/crowdstrike-spoke.html", "read": "2026-11-04" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/crowdstrike-spoke.html", "read": "2026-11-04" }, "edr_quarantine_file": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/crowdstrike-spoke.html", "read": "2026-11-04" }, "edr_run_script": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/crowdstrike-spoke.html", "read": "2026-11-04" }, "edr_block_hash": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/crowdstrike-spoke.html", "read": "2026-11-04" }, "id_disable_user": { "status": "native", "targets": [ "Okta spoke: Suspend User", "Microsoft Entra ID spoke: User Offboarding sample flow (disables the Entra account)" ], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/okta-v2-spoke.html", "extra_urls": [ "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/microsoft-azure-ad-spoke.html" ], "read": "2026-11-04" }, "id_pw_reset": { "status": "native", "targets": [ "Okta spoke: Expire User Password, Reset to Temporary Password", "Microsoft Entra ID spoke: Reset Password" ], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/okta-v2-spoke.html", "extra_urls": [ "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/microsoft-azure-ad-spoke.html" ], "read": "2026-11-04" }, "id_revoke_sessions": { "status": "native", "targets": [ "Okta spoke: Clear User Session", "Microsoft Entra ID spoke: Revoke User SignIn Sessions" ], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/okta-v2-spoke.html", "extra_urls": [ "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/microsoft-azure-ad-spoke.html" ], "read": "2026-11-04" }, "id_mfa_reenroll": { "status": "native", "targets": [ "Okta spoke: Reset User Factors", "AWS IAM spoke: Deactivate MFA Device" ], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/okta-v2-spoke.html", "extra_urls": [ "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/aws-iam-spoke.html" ], "read": "2026-11-04" }, "id_remove_group": { "status": "native", "targets": [ "Okta spoke: Remove User From Group", "Microsoft Entra ID spoke: Remove User from Group", "AWS IAM spoke: Remove User from Group" ], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/okta-v2-spoke.html", "extra_urls": [ "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/microsoft-azure-ad-spoke.html", "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/aws-iam-spoke.html" ], "read": "2026-11-04" }, "em_delete_msg": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/okta-v2-spoke.html", "read": "2026-11-04", "note": "Exchange Online and Gmail spokes appear in the spoke index but their action lists were not read." }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/okta-v2-spoke.html", "read": "2026-11-04" }, "em_block_sender": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/okta-v2-spoke.html", "read": "2026-11-04" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/okta-v2-spoke.html", "read": "2026-11-04" }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/okta-v2-spoke.html", "read": "2026-11-04" }, "cl_disable_iam": { "status": "native", "targets": [ "AWS IAM spoke: Delete Access Key for User, Delete Login Profile, Delete User" ], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/aws-iam-spoke.html", "read": "2026-11-04", "note": "Delete actions; no disable flag." }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/aws-iam-spoke.html", "read": "2026-11-04" }, "cl_isolate_instance": { "status": "native", "targets": [ "Amazon EC2 spoke: Stop Instances", "Microsoft Azure Virtual Machine spoke: Power Off Virtual Machine" ], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/amazon-ec2-spoke.html", "extra_urls": [ "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/azure-vir-mach-spoke.html" ], "read": "2026-11-04" }, "cl_change_sg": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/amazon-ec2-spoke.html", "read": "2026-11-04", "note": "EC2 spoke actions read: images, key pairs, tags, instance attributes, stop instances; no security group rule action." }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/okta-v2-spoke.html", "read": "2026-11-04", "note": "Okta and Entra spokes list Revoke User Application Access (removes an app assignment), not an OAuth consent grant." }, "nw_block_fw": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/azure-vir-net-spoke.html", "read": "2026-11-04", "note": "Firewall block request integrations were not found in the Integration Hub spoke index read." }, "nw_block_proxy_dns": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/azure-vir-net-spoke.html", "read": "2026-11-04" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/azure-vir-net-spoke.html", "read": "2026-11-04" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://www.servicenow.com/docs/r/xanadu/integrate-applications/integration-hub/azure-vir-net-spoke.html", "read": "2026-11-04" } } }, { "slug": "blink-ops", "name": "BlinkOps", "ranked": false, "counts": { "native": 14, "partner": 0, "custom": 3, "not_documented": 8 }, "coverage_share_pct": 56, "read": "2026-11-03", "cells": { "edr_isolate": { "status": "native", "targets": [ "CrowdStrike: Isolate Endpoint", "Microsoft Defender for Endpoint: Isolate Machine", "SentinelOne: Isolate Endpoint", "Cortex XDR: Isolate Endpoint" ], "docs_url": "https://docs.blinkops.com/docs/integrations/crowdstrike", "extra_urls": [ "https://docs.blinkops.com/docs/integrations/microsoft-defender-for-endpoint", "https://docs.blinkops.com/docs/integrations/sentinelone", "https://docs.blinkops.com/docs/integrations/cortex-xdr" ], "read": "2026-11-03" }, "edr_release": { "status": "native", "targets": [ "CrowdStrike: Lift Endpoint Isolation", "Microsoft Defender for Endpoint: Release Machine Isolation", "SentinelOne: Lift Endpoint Isolation", "Cortex XDR: Lift Endpoint Isolation" ], "docs_url": "https://docs.blinkops.com/docs/integrations/crowdstrike", "extra_urls": [ "https://docs.blinkops.com/docs/integrations/microsoft-defender-for-endpoint", "https://docs.blinkops.com/docs/integrations/sentinelone", "https://docs.blinkops.com/docs/integrations/cortex-xdr" ], "read": "2026-11-03" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://docs.blinkops.com/docs/integrations/crowdstrike", "read": "2026-11-03", "note": "CrowdStrike lists RTR command actions (run command, admin command) but no named kill action." }, "edr_quarantine_file": { "status": "native", "targets": [ "Microsoft Defender for Endpoint: Stop and Quarantine File" ], "docs_url": "https://docs.blinkops.com/docs/integrations/microsoft-defender-for-endpoint", "read": "2026-11-03" }, "edr_run_script": { "status": "native", "targets": [ "CrowdStrike: Run Command on a Single Host", "Microsoft Defender for Endpoint: Run Script on Machine", "Cortex XDR: Execute Python Script" ], "docs_url": "https://docs.blinkops.com/docs/integrations/crowdstrike", "extra_urls": [ "https://docs.blinkops.com/docs/integrations/microsoft-defender-for-endpoint", "https://docs.blinkops.com/docs/integrations/cortex-xdr" ], "read": "2026-11-03" }, "edr_block_hash": { "status": "native", "targets": [ "SentinelOne: Ban Hash, Add to Block List", "Cortex XDR: Add Files to Block List", "CrowdStrike: Create Indicator", "Microsoft Defender for Endpoint: Create or Update Indicator" ], "docs_url": "https://docs.blinkops.com/docs/integrations/sentinelone", "extra_urls": [ "https://docs.blinkops.com/docs/integrations/cortex-xdr", "https://docs.blinkops.com/docs/integrations/crowdstrike", "https://docs.blinkops.com/docs/integrations/microsoft-defender-for-endpoint" ], "read": "2026-11-03" }, "id_disable_user": { "status": "native", "targets": [ "Okta: Suspend User, Deactivate User" ], "docs_url": "https://docs.blinkops.com/docs/integrations/okta", "read": "2026-11-03" }, "id_pw_reset": { "status": "native", "targets": [ "Okta: Reset Password" ], "docs_url": "https://docs.blinkops.com/docs/integrations/okta", "read": "2026-11-03" }, "id_revoke_sessions": { "status": "native", "targets": [ "Okta: Revoke All User Sessions", "Microsoft Entra ID: Revoke User Sessions", "Google Admin Console: Delete All Directory Tokens" ], "docs_url": "https://docs.blinkops.com/docs/integrations/okta", "extra_urls": [ "https://docs.blinkops.com/docs/integrations/microsoft-entra-id", "https://docs.blinkops.com/docs/integrations/google-admin-console" ], "read": "2026-11-03" }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://docs.blinkops.com/docs/integrations/okta", "read": "2026-11-03", "note": "Okta lists Get a User's Factors only; Entra lists List User Authentication Methods only." }, "id_remove_group": { "status": "native", "targets": [ "Okta: Remove User From Group", "Microsoft Entra ID: Remove Member From Group", "Google Admin Console: Remove User From Group" ], "docs_url": "https://docs.blinkops.com/docs/integrations/okta", "extra_urls": [ "https://docs.blinkops.com/docs/integrations/microsoft-entra-id", "https://docs.blinkops.com/docs/integrations/google-admin-console" ], "read": "2026-11-03" }, "em_delete_msg": { "status": "native", "targets": [ "Microsoft Outlook: Delete Email, Permanently Delete Email", "Gmail: Delete Gmail Message", "Mimecast: Create Remediation Incident" ], "docs_url": "https://docs.blinkops.com/docs/integrations/microsoft-outlook", "extra_urls": [ "https://docs.blinkops.com/docs/integrations/gmail", "https://docs.blinkops.com/docs/integrations/mimecast" ], "read": "2026-11-03" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://docs.blinkops.com/docs/integrations/mimecast", "read": "2026-11-03" }, "em_block_sender": { "status": "custom", "targets": [ "Mimecast: Mimecast Custom Action (generic API call step)" ], "docs_url": "https://docs.blinkops.com/docs/integrations/mimecast", "read": "2026-11-03", "note": "No dedicated block sender action listed; the integration exposes a generic custom action step." }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://docs.blinkops.com/docs/integrations/mimecast", "read": "2026-11-03" }, "em_release_quarantine": { "status": "native", "targets": [ "Mimecast: Release Message Hold" ], "docs_url": "https://docs.blinkops.com/docs/integrations/mimecast", "read": "2026-11-03" }, "cl_disable_iam": { "status": "custom", "targets": [ "AWS: Run AWS CLI Script step", "AWS: IAM Put User Policy" ], "docs_url": "https://docs.blinkops.com/docs/integrations/aws", "read": "2026-11-03", "note": "AWS actions list IAM create access key, create login profile, delete user and put user policy; no update access key. Disable requires the CLI script step." }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://docs.blinkops.com/docs/integrations/aws", "read": "2026-11-03" }, "cl_isolate_instance": { "status": "native", "targets": [ "AWS: EC2 Stop Instances", "Google Cloud: Suspend Compute Instance", "Azure: Stop Virtual Machine" ], "docs_url": "https://docs.blinkops.com/docs/integrations/aws", "extra_urls": [ "https://docs.blinkops.com/docs/integrations/gcp", "https://docs.blinkops.com/docs/integrations/azure" ], "read": "2026-11-03" }, "cl_change_sg": { "status": "custom", "targets": [ "AWS: Run AWS CLI Script step", "AWS: EC2 Create Security Group, Delete Security Group" ], "docs_url": "https://docs.blinkops.com/docs/integrations/aws", "read": "2026-11-03", "note": "Group create and delete exist; rule changes need the CLI script step." }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://docs.blinkops.com/docs/integrations/microsoft-entra-id", "read": "2026-11-03" }, "nw_block_fw": { "status": "native", "targets": [ "Fortinet FortiGate: Add Address, Append Address to Group" ], "docs_url": "https://docs.blinkops.com/docs/integrations/fortigate", "read": "2026-11-03", "note": "Address and group management; the deny policy must already exist." }, "nw_block_proxy_dns": { "status": "native", "targets": [ "Zscaler Internet Access: Update Denylist URLs, Denylist Action" ], "docs_url": "https://docs.blinkops.com/docs/integrations/zscaler-internet-access", "read": "2026-11-03" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://docs.blinkops.com/docs/integrations/cisco-ise", "read": "2026-11-03", "note": "Cisco ISE lists Get Endpoints, Get Network Devices, Get Authentication Session List only." }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://docs.blinkops.com/docs/integrations/vectra-detect", "read": "2026-11-03", "note": "Vectra Detect lists notes, fixed marking and searches." } } }, { "slug": "cyware", "name": "Cyware", "ranked": true, "counts": { "native": 17, "partner": 0, "custom": 0, "not_documented": 8 }, "coverage_share_pct": 68, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "native", "targets": [ "CrowdStrike Falcon: Contain a Host", "Microsoft Defender for Endpoint: Isolate a Machine", "Cortex XDR: Isolate Endpoints" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/endpoint/crowdstrike-falcon/crowdstrike-falcon-3-0-0/", "extra_urls": [ "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/microsoft-defender/microsoft-defender-for-endpoint-2-0-0/", "https://techdocs.cyware.com/integrations/orchestrate-integrations/endpoint/palo-alto-cortex-xdr/" ], "read": "2026-11-04" }, "edr_release": { "status": "native", "targets": [ "CrowdStrike Falcon: Lift Host Containment", "Microsoft Defender for Endpoint: Remove Machine from Isolation", "Cortex XDR: Unisolate Endpoint" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/endpoint/crowdstrike-falcon/crowdstrike-falcon-3-0-0/", "extra_urls": [ "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/microsoft-defender/microsoft-defender-for-endpoint-2-0-0/", "https://techdocs.cyware.com/integrations/orchestrate-integrations/endpoint/palo-alto-cortex-xdr/" ], "read": "2026-11-04" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/endpoint/crowdstrike-falcon/crowdstrike-falcon-3-0-0/", "read": "2026-11-04" }, "edr_quarantine_file": { "status": "native", "targets": [ "Microsoft Defender for Endpoint: Stop Execution and Quarantine a File", "Cortex XDR: Quarantine Files" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/microsoft-defender/microsoft-defender-for-endpoint-2-0-0/", "extra_urls": [ "https://techdocs.cyware.com/integrations/orchestrate-integrations/endpoint/palo-alto-cortex-xdr/" ], "read": "2026-11-04" }, "edr_run_script": { "status": "native", "targets": [ "SentinelOne: Run Remote Script", "CrowdStrike Falcon: Execute Command Single Host (Real Time Response)" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/endpoint/sentinelone/", "extra_urls": [ "https://techdocs.cyware.com/integrations/orchestrate-integrations/endpoint/crowdstrike-falcon/crowdstrike-falcon-3-0-0/" ], "read": "2026-11-04" }, "edr_block_hash": { "status": "native", "targets": [ "SentinelOne: Add Hash to Blacklist", "CrowdStrike Falcon: Update Indicators" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/endpoint/sentinelone/", "extra_urls": [ "https://techdocs.cyware.com/integrations/orchestrate-integrations/endpoint/crowdstrike-falcon/crowdstrike-falcon-3-0-0/" ], "read": "2026-11-04" }, "id_disable_user": { "status": "native", "targets": [ "Microsoft Active Directory v2: Disable user account", "Okta: Deactivate User, Suspend User" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/authentication/microsoft-active-directory-v2/", "extra_urls": [ "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/okta/" ], "read": "2026-11-04" }, "id_pw_reset": { "status": "native", "targets": [ "Okta: Reset User Password", "Microsoft Active Directory v2: Expire password" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/okta/", "extra_urls": [ "https://techdocs.cyware.com/integrations/orchestrate-integrations/authentication/microsoft-active-directory-v2/" ], "read": "2026-11-04" }, "id_revoke_sessions": { "status": "native", "targets": [ "Okta: Clear User Sessions", "Microsoft Entra ID: Revoke Session of a User" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/okta/", "extra_urls": [ "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/microsoft-entra-id/" ], "read": "2026-11-04" }, "id_mfa_reenroll": { "status": "native", "targets": [ "Okta: Reset Factors For User" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/okta/", "read": "2026-11-04" }, "id_remove_group": { "status": "native", "targets": [ "Okta: Remove User From Group", "Microsoft Active Directory v2: Remove User From Group", "AWS IAM: Remove User from Group" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/okta/", "extra_urls": [ "https://techdocs.cyware.com/integrations/orchestrate-integrations/authentication/microsoft-active-directory-v2/", "https://techdocs.cyware.com/integrations/orchestrate-integrations/authentication/aws-identity-and-access-management/" ], "read": "2026-11-04" }, "em_delete_msg": { "status": "native", "targets": [ "Gmail: Delete Emails with Specific Email ID, Delete Emails with Specific Subject" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/it-services/gmail/", "read": "2026-11-04", "note": "Gmail query-based delete. Microsoft Exchange Online PowerShell and Exchange Web Services integrations exist but their pages returned no action text." }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/it-services/gmail/", "read": "2026-11-04" }, "em_block_sender": { "status": "native", "targets": [ "Mimecast: Block Sender" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/email-gateway/mimecast/mimecast-3-0-0/", "read": "2026-11-04" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/email-gateway/mimecast/mimecast-3-0-0/", "read": "2026-11-04", "note": "Mimecast v3 page lists sender policies, groups and held message release; no managed URL removal." }, "em_release_quarantine": { "status": "native", "targets": [ "Mimecast: Release Held Message" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/email-gateway/mimecast/mimecast-3-0-0/", "read": "2026-11-04" }, "cl_disable_iam": { "status": "native", "targets": [ "AWS IAM: Delete Access Key" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/authentication/aws-identity-and-access-management/", "read": "2026-11-04", "note": "Delete, not disable." }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/authentication/aws-identity-and-access-management/", "read": "2026-11-04" }, "cl_isolate_instance": { "status": "not documented", "targets": [], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/it-services/amazon-elastic-compute-cloud/", "read": "2026-11-04", "note": "EC2 integration page returned no action text on the read date." }, "cl_change_sg": { "status": "not documented", "targets": [], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/it-services/amazon-elastic-compute-cloud/", "read": "2026-11-04" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/microsoft-entra-id/", "read": "2026-11-04" }, "nw_block_fw": { "status": "native", "targets": [ "Fortinet FortiGate Firewall: Ban IP", "Palo Alto Firewall: Add Address Object to Address Group" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/fortinet-fortigate-firewall/", "extra_urls": [ "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/palo-alto-firewall/palo-alto-firewall-2-0-0/" ], "read": "2026-11-04" }, "nw_block_proxy_dns": { "status": "native", "targets": [ "Zscaler Secure Internet Access: Add URLs to Blocklist" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/zscaler-secure-internet-access/zscaler-secure-internet-access-3-0-0/", "read": "2026-11-04" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/cisco-network-access-control/", "read": "2026-11-04", "note": "Cisco NAC page lists a search query action only." }, "nw_ndr_list": { "status": "native", "targets": [ "Darktrace: Add Domain to Intel Feed, Add IPs to Intel Feed" ], "docs_url": "https://techdocs.cyware.com/integrations/orchestrate-integrations/network-security/darktrace/", "read": "2026-11-04" } } }, { "slug": "threatconnect", "name": "ThreatConnect", "ranked": false, "counts": { "native": 3, "partner": 2, "custom": 0, "not_documented": 20 }, "coverage_share_pct": 20, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "partner", "targets": [ "CrowdStrike Falcon Insight via the NetWitness Response Action Proxy integration: isolate_device" ], "docs_url": "https://knowledge.threatconnect.com/docs/netwitness-response-action-proxy-with-crowdstrike-falcon-insight-user-guide", "read": "2026-11-04", "note": "Documented as a proxy for the RSA NetWitness Response server, not as a ThreatConnect playbook action." }, "edr_release": { "status": "partner", "targets": [ "CrowdStrike Falcon Insight via the NetWitness Response Action Proxy integration: unisolate_device" ], "docs_url": "https://knowledge.threatconnect.com/docs/netwitness-response-action-proxy-with-crowdstrike-falcon-insight-user-guide", "read": "2026-11-04" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/microsoft-defender-for-endpoint-integration-user-guide", "read": "2026-11-04", "note": "The Defender for Endpoint playbook app 'provides a powerful set of actions' but the action list lives on marketplace.threatconnect.com, which was unreachable (TLS handshake failure) on the read date." }, "edr_quarantine_file": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/microsoft-defender-for-endpoint-integration-user-guide", "read": "2026-11-04" }, "edr_run_script": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/microsoft-defender-for-endpoint-integration-user-guide", "read": "2026-11-04" }, "edr_block_hash": { "status": "native", "targets": [ "CrowdStrike Falcon Insight: deploy File Indicators to Falcon (Extract app)" ], "docs_url": "https://knowledge.threatconnect.com/docs/crowdstrike-falcon-insight-extract-integration-configuration-guide", "read": "2026-11-04", "note": "Guide says the app deploys Address, Host and File Indicators to Falcon Insight; the exact Falcon IOC action (detect or prevent) is in the PDF." }, "id_disable_user": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "id_pw_reset": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "id_revoke_sessions": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "id_remove_group": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "em_delete_msg": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "em_block_sender": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "cl_disable_iam": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "cl_isolate_instance": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "cl_change_sg": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "nw_block_fw": { "status": "native", "targets": [ "Palo Alto Networks NGFW: deploy Address and URL Indicators to NGFW or Panorama for alerting and blocking" ], "docs_url": "https://knowledge.threatconnect.com/docs/palo-alto-networks-ngfw-integration-installation-and-configuration-guide", "read": "2026-11-04" }, "nw_block_proxy_dns": { "status": "native", "targets": [ "Zscaler Internet Access content pack: Add URL or Host to ZIA Blocked Malicious URLs", "Cisco Umbrella: add and remove Host and URL Indicators" ], "docs_url": "https://knowledge.threatconnect.com/docs/zscaler-internet-access-content-pack-use-cases", "extra_urls": [ "https://knowledge.threatconnect.com/docs/cisco-umbrella-integration-configuration-guide" ], "read": "2026-11-04" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://knowledge.threatconnect.com/docs/apps-and-integrations", "read": "2026-11-04" } } }, { "slug": "revelstoke-arctic-wolf", "name": "Revelstoke (Arctic Wolf)", "ranked": false, "counts": { "native": 0, "partner": 0, "custom": 0, "not_documented": 25 }, "coverage_share_pct": 0, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-enhances-managed-detection-and-response-service-with-managed-containment/", "read": "2026-11-04", "note": "Arctic Wolf announced Managed Containment (host isolation) in its MDR service in December 2019. That is a managed service feature, not a documented SOAR action, so it is not scored." }, "edr_release": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "edr_quarantine_file": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "edr_run_script": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "edr_block_hash": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "id_disable_user": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "id_pw_reset": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "id_revoke_sessions": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "id_remove_group": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "em_delete_msg": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "em_block_sender": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "cl_disable_iam": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "cl_isolate_instance": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "cl_change_sg": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "nw_block_fw": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "nw_block_proxy_dns": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-announces-intent-to-acquire-revelstoke/", "read": "2026-11-04" } } }, { "slug": "crowdstrike-falcon-fusion", "name": "CrowdStrike Falcon Fusion SOAR", "ranked": true, "counts": { "native": 0, "partner": 0, "custom": 0, "not_documented": 25 }, "coverage_share_pct": 0, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "edr_release": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "edr_quarantine_file": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "edr_run_script": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "edr_block_hash": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "id_disable_user": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "id_pw_reset": { "status": "not documented", "targets": [], "docs_url": "https://www.crowdstrike.com/en-us/blog/how-to-scale-soc-automation-with-falcon-fusion-soar/", "read": "2026-11-04", "note": "Blog (2026-02-11) gives 'forcing a password reset when an account is flagged as compromised' as an example automation but does not document the action or its target." }, "id_revoke_sessions": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "id_remove_group": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "em_delete_msg": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "em_block_sender": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "cl_disable_iam": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "cl_isolate_instance": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "cl_change_sg": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "nw_block_fw": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "nw_block_proxy_dns": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://falcon.crowdstrike.com/documentation/", "read": "2026-11-04", "note": "Falcon documentation portal redirects to a login page; public marketing pages name no Fusion action." } } }, { "slug": "exabeam", "name": "Exabeam", "ranked": false, "counts": { "native": 9, "partner": 0, "custom": 0, "not_documented": 16 }, "coverage_share_pct": 36, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "native", "targets": [ "Microsoft Defender ATP service: Quarantine Host" ], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-microsoft-windows-defender-atp-service.html", "read": "2026-11-04", "note": "Incident Responder (legacy) service page, last updated 2022." }, "edr_release": { "status": "native", "targets": [ "Microsoft Defender ATP service: Un quarantine Host" ], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-microsoft-windows-defender-atp-service.html", "read": "2026-11-04" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-crowdstrike-falcon-host-api-service-service.html", "read": "2026-11-04", "note": "CrowdStrike, SentinelOneV2 and Cisco AMP service pages describe the service but do not list action names." }, "edr_quarantine_file": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-microsoft-windows-defender-atp-service.html", "read": "2026-11-04", "note": "Defender ATP page lists 'manage files and applications on a host' and Restrict App Execution; no file quarantine action name." }, "edr_run_script": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-microsoft-windows-defender-atp-service.html", "read": "2026-11-04" }, "edr_block_hash": { "status": "native", "targets": [ "Netskope service: update file hash lists" ], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-netskope-service.html", "read": "2026-11-04" }, "id_disable_user": { "status": "native", "targets": [ "Microsoft Active Directory service: Disable user account" ], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-microsoft-active-directory--ad---latest--service.html", "read": "2026-11-04" }, "id_pw_reset": { "status": "native", "targets": [ "Microsoft Active Directory service: Reset password, Expire Password" ], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-microsoft-active-directory--ad---latest--service.html", "read": "2026-11-04" }, "id_revoke_sessions": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-okta-service.html", "read": "2026-11-04", "note": "Okta page says 'manage users and run other Okta actions' without names." }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-okta-service.html", "read": "2026-11-04" }, "id_remove_group": { "status": "native", "targets": [ "Microsoft Active Directory service: Remove User From Group" ], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-microsoft-active-directory--ad---latest--service.html", "read": "2026-11-04" }, "em_delete_msg": { "status": "native", "targets": [ "Microsoft Exchange service: delete emails", "Microsoft Outlook Office 365 service: delete emails" ], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-microsoft-exchange-service.html", "extra_urls": [ "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-microsoft-outlook-office-365-service.html" ], "read": "2026-11-04" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-microsoft-exchange-service.html", "read": "2026-11-04" }, "em_block_sender": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-google-gmail-service.html", "read": "2026-11-04" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-google-gmail-service.html", "read": "2026-11-04" }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-google-gmail-service.html", "read": "2026-11-04" }, "cl_disable_iam": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-amazon-elastic-compute-cloud--ec2--service.html", "read": "2026-11-04", "note": "EC2 page says 'manage instances, groups, accounts' without action names." }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-amazon-elastic-compute-cloud--ec2--service.html", "read": "2026-11-04" }, "cl_isolate_instance": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-amazon-elastic-compute-cloud--ec2--service.html", "read": "2026-11-04" }, "cl_change_sg": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-amazon-elastic-compute-cloud--ec2--service.html", "read": "2026-11-04" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-okta-service.html", "read": "2026-11-04" }, "nw_block_fw": { "status": "native", "targets": [ "Palo Alto Networks Firewall service: block and unblock IP addresses and URLs", "Fortinet service: block and unblock IP addresses" ], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-palo-alto-networks-firewall-service.html", "extra_urls": [ "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-fortinet-service.html" ], "read": "2026-11-04" }, "nw_block_proxy_dns": { "status": "native", "targets": [ "Cisco Umbrella Enforcement service: block malicious or suspicious domains", "Zscaler service: manage blacklists" ], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-cisco-umbrella-enforcement-service.html", "extra_urls": [ "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-zscaler-service.html" ], "read": "2026-11-04" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-cisco-services-engine--ise--service.html", "read": "2026-11-04", "note": "Cisco ISE page says 'get information about devices and run other Cisco ISE actions'." }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-netskope-service.html", "read": "2026-11-04" } } }, { "slug": "dropzone-ai", "name": "Dropzone AI", "ranked": true, "counts": { "native": 2, "partner": 0, "custom": 0, "not_documented": 23 }, "coverage_share_pct": 8, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator/crowdstrike_remediator.md", "read": "2026-11-04", "note": "CrowdStrike Remediator page asks for Hosts and IOC Management read and write scopes and says containment actions are enabled from a list shown as a screenshot; no action name in text." }, "edr_release": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "edr_quarantine_file": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "edr_run_script": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "edr_block_hash": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator/crowdstrike_remediator.md", "read": "2026-11-04", "note": "IOC Management write scope is required but no hash block action is named in text." }, "id_disable_user": { "status": "native", "targets": [ "Google Workspace Remediator: Suspend User" ], "docs_url": "https://docs.dropzone.ai/integrations/remediator/google-workspace_remediator.md", "read": "2026-11-04" }, "id_pw_reset": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator/okta_remediator.md", "read": "2026-11-04", "note": "Okta and Microsoft 365 remediator pages list containment actions only as screenshots." }, "id_revoke_sessions": { "status": "native", "targets": [ "Google Workspace Remediator: Revoke User Sessions" ], "docs_url": "https://docs.dropzone.ai/integrations/remediator/google-workspace_remediator.md", "read": "2026-11-04" }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "id_remove_group": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "em_delete_msg": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "em_block_sender": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "cl_disable_iam": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "cl_isolate_instance": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "cl_change_sg": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "nw_block_fw": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "nw_block_proxy_dns": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://docs.dropzone.ai/integrations/remediator.md", "read": "2026-11-04" } } }, { "slug": "prophet-security", "name": "Prophet Security", "ranked": true, "counts": { "native": 0, "partner": 0, "custom": 0, "not_documented": 25 }, "coverage_share_pct": 0, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/ai-soc-analyst", "read": "2026-11-04", "note": "Page says automated remediation runs 'from notifications to quarantining a machine, previewed before it runs'. No target system or action document is given, so it is not scored native." }, "edr_release": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "edr_quarantine_file": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "edr_run_script": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "edr_block_hash": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "id_disable_user": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "id_pw_reset": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "id_revoke_sessions": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "id_remove_group": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "em_delete_msg": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "em_block_sender": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "cl_disable_iam": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "cl_isolate_instance": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "cl_change_sg": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "nw_block_fw": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "nw_block_proxy_dns": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://www.prophetsecurity.ai/integrations", "read": "2026-11-04" } } }, { "slug": "mate-security", "name": "Mate Security", "ranked": true, "counts": { "native": 0, "partner": 0, "custom": 0, "not_documented": 25 }, "coverage_share_pct": 0, "read": "2026-11-04", "cells": { "edr_isolate": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "edr_release": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "edr_kill": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "edr_quarantine_file": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "edr_run_script": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "edr_block_hash": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "id_disable_user": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "id_pw_reset": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "id_revoke_sessions": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04", "note": "Platform page uses 'Revoke the session, keep the account' as an example of its smallest-action principle; it names no identity provider and is not an action document." }, "id_mfa_reenroll": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "id_remove_group": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "em_delete_msg": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "em_quarantine_msg": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "em_block_sender": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "em_url_exemption": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "em_release_quarantine": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "cl_disable_iam": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "cl_revoke_session": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "cl_isolate_instance": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "cl_change_sg": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "cl_revoke_oauth": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "nw_block_fw": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "nw_block_proxy_dns": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "nw_nac": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" }, "nw_ndr_list": { "status": "not documented", "targets": [], "docs_url": "https://mate.security/platform", "read": "2026-11-04" } } } ] }