Containment coverage scorecard

Which of 25 containment actions each platform documents against a named target, across EDR, identity, email, cloud and network. Eighteen platforms, fourteen of them ranked, read 2026-11-03 and 2026-11-04.

The grid

native, vendor-documented
partner or third-party documented
custom step only
not documented on the pages read

Containment coverage: 18 platforms by 25 actions
Platform	EDR						Identity					Email					Cloud					Network
Platform	Isolate host	Release isolation	Kill process	Quarantine file	Run script or live response	Block hash	Disable user	Force password reset	Revoke sessions or tokens	Require MFA re-enrolment	Remove from group or role	Delete a delivered message	Quarantine a delivered message	Block sender or domain	Remove a URL rewrite exemption	Pull from quarantine	Disable IAM user or access key	Revoke cloud session	Isolate or stop an instance	Change a security group or firewall rule	Revoke OAuth app consent	Block IP or domain at the firewall	Block at the proxy or DNS filter	Disable a switch port or NAC quarantine	Add to a threat list on the NDR
Tines22 of 25 documented													Tines: Quarantine a delivered message, not documented								Tines: Revoke OAuth app consent, not documented			Tines: Disable a switch port or NAC quarantine, not documented
Palo Alto Cortex XSOAR20 of 25 documented													Palo Alto Cortex XSOAR: Quarantine a delivered message, not documented		Palo Alto Cortex XSOAR: Remove a URL rewrite exemption, not documented			Palo Alto Cortex XSOAR: Revoke cloud session, not documented						Palo Alto Cortex XSOAR: Disable a switch port or NAC quarantine, not documented	Palo Alto Cortex XSOAR: Add to a threat list on the NDR, not documented
D3 Security19 of 25 documented										D3 Security: Require MFA re-enrolment, not documented			D3 Security: Quarantine a delivered message, not documented		D3 Security: Remove a URL rewrite exemption, not documented		D3 Security: Disable IAM user or access key, not documented	D3 Security: Revoke cloud session, not documented							D3 Security: Add to a threat list on the NDR, not documented
Google Security Operations19 of 25 documented										Google Security Operations: Require MFA re-enrolment, not documented			Google Security Operations: Quarantine a delivered message, not documented		Google Security Operations: Remove a URL rewrite exemption, not documented			Google Security Operations: Revoke cloud session, not documented			Google Security Operations: Revoke OAuth app consent, not documented				Google Security Operations: Add to a threat list on the NDR, not documented
Splunk SOAR (Cisco)19 of 25 documented										Splunk SOAR (Cisco): Require MFA re-enrolment, not documented			Splunk SOAR (Cisco): Quarantine a delivered message, not documented			Splunk SOAR (Cisco): Pull from quarantine, not documented		Splunk SOAR (Cisco): Revoke cloud session, not documented			Splunk SOAR (Cisco): Revoke OAuth app consent, not documented				Splunk SOAR (Cisco): Add to a threat list on the NDR, not documented
Swimlane18 of 25 documented			Swimlane: Kill process, not documented										Swimlane: Quarantine a delivered message, not documented		Swimlane: Remove a URL rewrite exemption, not documented	Swimlane: Pull from quarantine, not documented		Swimlane: Revoke cloud session, not documented			Swimlane: Revoke OAuth app consent, not documented				Swimlane: Add to a threat list on the NDR, not documented
Cyware17 of 25 documented			Cyware: Kill process, not documented										Cyware: Quarantine a delivered message, not documented		Cyware: Remove a URL rewrite exemption, not documented			Cyware: Revoke cloud session, not documented	Cyware: Isolate or stop an instance, not documented	Cyware: Change a security group or firewall rule, not documented	Cyware: Revoke OAuth app consent, not documented			Cyware: Disable a switch port or NAC quarantine, not documented
BlinkOps14 of 25 documented, not ranked			BlinkOps: Kill process, not documented							BlinkOps: Require MFA re-enrolment, not documented			BlinkOps: Quarantine a delivered message, not documented		BlinkOps: Remove a URL rewrite exemption, not documented			BlinkOps: Revoke cloud session, not documented			BlinkOps: Revoke OAuth app consent, not documented			BlinkOps: Disable a switch port or NAC quarantine, not documented	BlinkOps: Add to a threat list on the NDR, not documented
Torq13 of 25 documented			Torq: Kill process, not documented	Torq: Quarantine file, not documented							Torq: Remove from group or role, not documented		Torq: Quarantine a delivered message, not documented	Torq: Block sender or domain, not documented	Torq: Remove a URL rewrite exemption, not documented	Torq: Pull from quarantine, not documented		Torq: Revoke cloud session, not documented			Torq: Revoke OAuth app consent, not documented	Torq: Block IP or domain at the firewall, not documented		Torq: Disable a switch port or NAC quarantine, not documented	Torq: Add to a threat list on the NDR, not documented
Exabeam9 of 25 documented, not ranked			Exabeam: Kill process, not documented	Exabeam: Quarantine file, not documented	Exabeam: Run script or live response, not documented				Exabeam: Revoke sessions or tokens, not documented	Exabeam: Require MFA re-enrolment, not documented			Exabeam: Quarantine a delivered message, not documented	Exabeam: Block sender or domain, not documented	Exabeam: Remove a URL rewrite exemption, not documented	Exabeam: Pull from quarantine, not documented	Exabeam: Disable IAM user or access key, not documented	Exabeam: Revoke cloud session, not documented	Exabeam: Isolate or stop an instance, not documented	Exabeam: Change a security group or firewall rule, not documented	Exabeam: Revoke OAuth app consent, not documented			Exabeam: Disable a switch port or NAC quarantine, not documented	Exabeam: Add to a threat list on the NDR, not documented
Microsoft Sentinel9 of 25 documented			Microsoft Sentinel: Kill process, not documented	Microsoft Sentinel: Quarantine file, not documented		Microsoft Sentinel: Block hash, not documented		Microsoft Sentinel: Force password reset, not documented		Microsoft Sentinel: Require MFA re-enrolment, not documented			Microsoft Sentinel: Quarantine a delivered message, not documented	Microsoft Sentinel: Block sender or domain, not documented	Microsoft Sentinel: Remove a URL rewrite exemption, not documented	Microsoft Sentinel: Pull from quarantine, not documented	Microsoft Sentinel: Disable IAM user or access key, not documented	Microsoft Sentinel: Revoke cloud session, not documented			Microsoft Sentinel: Revoke OAuth app consent, not documented	Microsoft Sentinel: Block IP or domain at the firewall, not documented	Microsoft Sentinel: Block at the proxy or DNS filter, not documented	Microsoft Sentinel: Disable a switch port or NAC quarantine, not documented	Microsoft Sentinel: Add to a threat list on the NDR, not documented
ServiceNow Security Operations7 of 25 documented	ServiceNow Security Operations: Isolate host, not documented	ServiceNow Security Operations: Release isolation, not documented	ServiceNow Security Operations: Kill process, not documented	ServiceNow Security Operations: Quarantine file, not documented	ServiceNow Security Operations: Run script or live response, not documented	ServiceNow Security Operations: Block hash, not documented						ServiceNow Security Operations: Delete a delivered message, not documented	ServiceNow Security Operations: Quarantine a delivered message, not documented	ServiceNow Security Operations: Block sender or domain, not documented	ServiceNow Security Operations: Remove a URL rewrite exemption, not documented	ServiceNow Security Operations: Pull from quarantine, not documented		ServiceNow Security Operations: Revoke cloud session, not documented		ServiceNow Security Operations: Change a security group or firewall rule, not documented	ServiceNow Security Operations: Revoke OAuth app consent, not documented	ServiceNow Security Operations: Block IP or domain at the firewall, not documented	ServiceNow Security Operations: Block at the proxy or DNS filter, not documented	ServiceNow Security Operations: Disable a switch port or NAC quarantine, not documented	ServiceNow Security Operations: Add to a threat list on the NDR, not documented
ThreatConnect5 of 25 documented, not ranked			ThreatConnect: Kill process, not documented	ThreatConnect: Quarantine file, not documented	ThreatConnect: Run script or live response, not documented		ThreatConnect: Disable user, not documented	ThreatConnect: Force password reset, not documented	ThreatConnect: Revoke sessions or tokens, not documented	ThreatConnect: Require MFA re-enrolment, not documented	ThreatConnect: Remove from group or role, not documented	ThreatConnect: Delete a delivered message, not documented	ThreatConnect: Quarantine a delivered message, not documented	ThreatConnect: Block sender or domain, not documented	ThreatConnect: Remove a URL rewrite exemption, not documented	ThreatConnect: Pull from quarantine, not documented	ThreatConnect: Disable IAM user or access key, not documented	ThreatConnect: Revoke cloud session, not documented	ThreatConnect: Isolate or stop an instance, not documented	ThreatConnect: Change a security group or firewall rule, not documented	ThreatConnect: Revoke OAuth app consent, not documented			ThreatConnect: Disable a switch port or NAC quarantine, not documented	ThreatConnect: Add to a threat list on the NDR, not documented
Dropzone AI2 of 25 documented	Dropzone AI: Isolate host, not documented	Dropzone AI: Release isolation, not documented	Dropzone AI: Kill process, not documented	Dropzone AI: Quarantine file, not documented	Dropzone AI: Run script or live response, not documented	Dropzone AI: Block hash, not documented		Dropzone AI: Force password reset, not documented		Dropzone AI: Require MFA re-enrolment, not documented	Dropzone AI: Remove from group or role, not documented	Dropzone AI: Delete a delivered message, not documented	Dropzone AI: Quarantine a delivered message, not documented	Dropzone AI: Block sender or domain, not documented	Dropzone AI: Remove a URL rewrite exemption, not documented	Dropzone AI: Pull from quarantine, not documented	Dropzone AI: Disable IAM user or access key, not documented	Dropzone AI: Revoke cloud session, not documented	Dropzone AI: Isolate or stop an instance, not documented	Dropzone AI: Change a security group or firewall rule, not documented	Dropzone AI: Revoke OAuth app consent, not documented	Dropzone AI: Block IP or domain at the firewall, not documented	Dropzone AI: Block at the proxy or DNS filter, not documented	Dropzone AI: Disable a switch port or NAC quarantine, not documented	Dropzone AI: Add to a threat list on the NDR, not documented
CrowdStrike Falcon Fusion SOAR0 of 25 documented, docs behind login	CrowdStrike Falcon Fusion SOAR: Isolate host, not documented	CrowdStrike Falcon Fusion SOAR: Release isolation, not documented	CrowdStrike Falcon Fusion SOAR: Kill process, not documented	CrowdStrike Falcon Fusion SOAR: Quarantine file, not documented	CrowdStrike Falcon Fusion SOAR: Run script or live response, not documented	CrowdStrike Falcon Fusion SOAR: Block hash, not documented	CrowdStrike Falcon Fusion SOAR: Disable user, not documented	CrowdStrike Falcon Fusion SOAR: Force password reset, not documented	CrowdStrike Falcon Fusion SOAR: Revoke sessions or tokens, not documented	CrowdStrike Falcon Fusion SOAR: Require MFA re-enrolment, not documented	CrowdStrike Falcon Fusion SOAR: Remove from group or role, not documented	CrowdStrike Falcon Fusion SOAR: Delete a delivered message, not documented	CrowdStrike Falcon Fusion SOAR: Quarantine a delivered message, not documented	CrowdStrike Falcon Fusion SOAR: Block sender or domain, not documented	CrowdStrike Falcon Fusion SOAR: Remove a URL rewrite exemption, not documented	CrowdStrike Falcon Fusion SOAR: Pull from quarantine, not documented	CrowdStrike Falcon Fusion SOAR: Disable IAM user or access key, not documented	CrowdStrike Falcon Fusion SOAR: Revoke cloud session, not documented	CrowdStrike Falcon Fusion SOAR: Isolate or stop an instance, not documented	CrowdStrike Falcon Fusion SOAR: Change a security group or firewall rule, not documented	CrowdStrike Falcon Fusion SOAR: Revoke OAuth app consent, not documented	CrowdStrike Falcon Fusion SOAR: Block IP or domain at the firewall, not documented	CrowdStrike Falcon Fusion SOAR: Block at the proxy or DNS filter, not documented	CrowdStrike Falcon Fusion SOAR: Disable a switch port or NAC quarantine, not documented	CrowdStrike Falcon Fusion SOAR: Add to a threat list on the NDR, not documented
Mate Security0 of 25 documented	Mate Security: Isolate host, not documented	Mate Security: Release isolation, not documented	Mate Security: Kill process, not documented	Mate Security: Quarantine file, not documented	Mate Security: Run script or live response, not documented	Mate Security: Block hash, not documented	Mate Security: Disable user, not documented	Mate Security: Force password reset, not documented	Mate Security: Revoke sessions or tokens, not documented	Mate Security: Require MFA re-enrolment, not documented	Mate Security: Remove from group or role, not documented	Mate Security: Delete a delivered message, not documented	Mate Security: Quarantine a delivered message, not documented	Mate Security: Block sender or domain, not documented	Mate Security: Remove a URL rewrite exemption, not documented	Mate Security: Pull from quarantine, not documented	Mate Security: Disable IAM user or access key, not documented	Mate Security: Revoke cloud session, not documented	Mate Security: Isolate or stop an instance, not documented	Mate Security: Change a security group or firewall rule, not documented	Mate Security: Revoke OAuth app consent, not documented	Mate Security: Block IP or domain at the firewall, not documented	Mate Security: Block at the proxy or DNS filter, not documented	Mate Security: Disable a switch port or NAC quarantine, not documented	Mate Security: Add to a threat list on the NDR, not documented
Prophet Security0 of 25 documented	Prophet Security: Isolate host, not documented	Prophet Security: Release isolation, not documented	Prophet Security: Kill process, not documented	Prophet Security: Quarantine file, not documented	Prophet Security: Run script or live response, not documented	Prophet Security: Block hash, not documented	Prophet Security: Disable user, not documented	Prophet Security: Force password reset, not documented	Prophet Security: Revoke sessions or tokens, not documented	Prophet Security: Require MFA re-enrolment, not documented	Prophet Security: Remove from group or role, not documented	Prophet Security: Delete a delivered message, not documented	Prophet Security: Quarantine a delivered message, not documented	Prophet Security: Block sender or domain, not documented	Prophet Security: Remove a URL rewrite exemption, not documented	Prophet Security: Pull from quarantine, not documented	Prophet Security: Disable IAM user or access key, not documented	Prophet Security: Revoke cloud session, not documented	Prophet Security: Isolate or stop an instance, not documented	Prophet Security: Change a security group or firewall rule, not documented	Prophet Security: Revoke OAuth app consent, not documented	Prophet Security: Block IP or domain at the firewall, not documented	Prophet Security: Block at the proxy or DNS filter, not documented	Prophet Security: Disable a switch port or NAC quarantine, not documented	Prophet Security: Add to a threat list on the NDR, not documented
Revelstoke (Arctic Wolf)0 of 25 documented, not ranked	Revelstoke (Arctic Wolf): Isolate host, not documented	Revelstoke (Arctic Wolf): Release isolation, not documented	Revelstoke (Arctic Wolf): Kill process, not documented	Revelstoke (Arctic Wolf): Quarantine file, not documented	Revelstoke (Arctic Wolf): Run script or live response, not documented	Revelstoke (Arctic Wolf): Block hash, not documented	Revelstoke (Arctic Wolf): Disable user, not documented	Revelstoke (Arctic Wolf): Force password reset, not documented	Revelstoke (Arctic Wolf): Revoke sessions or tokens, not documented	Revelstoke (Arctic Wolf): Require MFA re-enrolment, not documented	Revelstoke (Arctic Wolf): Remove from group or role, not documented	Revelstoke (Arctic Wolf): Delete a delivered message, not documented	Revelstoke (Arctic Wolf): Quarantine a delivered message, not documented	Revelstoke (Arctic Wolf): Block sender or domain, not documented	Revelstoke (Arctic Wolf): Remove a URL rewrite exemption, not documented	Revelstoke (Arctic Wolf): Pull from quarantine, not documented	Revelstoke (Arctic Wolf): Disable IAM user or access key, not documented	Revelstoke (Arctic Wolf): Revoke cloud session, not documented	Revelstoke (Arctic Wolf): Isolate or stop an instance, not documented	Revelstoke (Arctic Wolf): Change a security group or firewall rule, not documented	Revelstoke (Arctic Wolf): Revoke OAuth app consent, not documented	Revelstoke (Arctic Wolf): Block IP or domain at the firewall, not documented	Revelstoke (Arctic Wolf): Block at the proxy or DNS filter, not documented	Revelstoke (Arctic Wolf): Disable a switch port or NAC quarantine, not documented	Revelstoke (Arctic Wolf): Add to a threat list on the NDR, not documented

Rows are sorted by actions documented. Each filled cell links to the vendor page read. A cell reads not documented when the pages read did not show the action; that is a finding about public material, not a claim that the action is absent. Platforms with a shaded row are not ranked on this site. Scroll sideways on a phone: the platform name stays in view.

25actions each

Counts per platform

Coverage share is native plus partner, divided by 25. Custom and not documented count as zero.
Platform	Native	Partner	Custom	Not documented	Coverage share
Tines	22	0	0	3	88 percent
Palo Alto Cortex XSOAR	20	0	0	5	80 percent
D3 Security	19	0	0	6	76 percent
Google Security Operations	19	0	0	6	76 percent
Splunk SOAR (Cisco)	18	1	0	6	76 percent
Swimlane	18	0	0	7	72 percent
Cyware	17	0	0	8	68 percent
BlinkOps (not ranked)	14	0	3	8	56 percent
Torq	13	0	0	12	52 percent
Exabeam (not ranked)	9	0	0	16	36 percent
Microsoft Sentinel	9	0	0	16	36 percent
ServiceNow Security Operations	7	0	0	18	28 percent
ThreatConnect (not ranked)	3	2	0	20	20 percent
Dropzone AI	2	0	0	23	8 percent
CrowdStrike Falcon Fusion SOAR (docs behind login)	0	0	0	25	0 percent
Mate Security	0	0	0	25	0 percent
Prophet Security	0	0	0	25	0 percent
Revelstoke (Arctic Wolf) (not ranked)	0	0	0	25	0 percent

Reading notes

The containment coverage scorecard answers one question for each of the 14 platforms: which containment actions does the vendor's own documentation show it can take against a named target system? It answers "is this action documented", not "does it work well". It carries 25 percent of every total on the rubric, the largest single weight, because an action that is not documented cannot be tested, gated or reviewed before you buy.

The 25 actions

They are the actions a responder reaches for first when stopping spread, in five domains: six on EDR, five on identity, five on email, five on cloud and four on network. Examples are isolate a host, disable a user, revoke sessions, delete a delivered message, disable an access key and block an address at the firewall. In email, delete and quarantine of a delivered message count as two actions. No platform was found to document a distinct quarantine of a delivered message, so that column is empty.

The four statuses

Each cell takes one status, with the page it was read from and the read date.

Native. A vendor-maintained integration, built-in action or vendor-published template documents this exact action against a named target.
Partner. Only a third party, a community project or the target vendor's own app documents it, or it is documented only as a proxy for another product.
Custom. The only documented route is a generic HTTP, command-line or script step. Every platform can call an API, so custom is never assumed.
Not documented. The pages read do not show the action. It may exist.

Native is the strict test. A statement that a platform integrates with a product does not meet it.

What the share means

The coverage share is native plus partner actions divided by 25, as a percentage to one decimal place. Custom and not documented count as zero. It measures documented breadth. It does not measure speed, reliability, approval quality, rollback or audit trail, and it is not a time-to-contain figure. A platform at 0 percent may still take actions its public pages do not show. That is a finding about public material, not about the product.

We read representative targets for each domain, not every integration a platform ships. Where documentation sits behind a login or a script-rendered portal, the scorecard says so and the row understates capability.

Dates and corrections

Documentation was read on 2026-11-03 and 2026-11-04, and the scorecard is re-read quarterly, next due 2027-02-03. The method page lists the sources read for each platform. Published time-to-contain figures sit apart on the evidence register, graded A to D. If a public page documents an action we marked not documented, send it to the corrections address and the cell will change.

Rows that understate a platform

Torq. Step catalogue is partly hidden behind '+N more'. Scores for actions only seen as absent may understate coverage.
Microsoft Sentinel. Sentinel template catalogue not fully enumerable from this environment; coverage is likely understated.
ServiceNow Security Operations. Likely understated for EDR, email and network because SIR-specific integration pages were not readable. Hardest docs to read.
ThreatConnect. Playbook app action lists unreachable; coverage is understated. Second hardest to read.
CrowdStrike Falcon Fusion SOAR. Docs gated behind login. Scores understate capability. Third hardest to read.
Exabeam. Action names are named only for AD and Defender ATP; most service pages describe purpose only. Incident Responder pages date from 2022. docs.exabeam.com returns 403 to a plain fetch of the landing page, so pages were reached from the sitemap.

Status definitions

native: A vendor-maintained integration, built-in action or vendor-published template documents this exact action against a named target.
partner: A third-party, community or target-vendor-published integration documents it, or the action is only documented as a proxy for another product.
custom: Only a generic HTTP, CLI or script step is shown for the target.
not documented: The pages read do not document the action. It may exist.

How the 25 actions were chosen and read is on the method page. The data is free to download. The coverage score feeds 25 percent of each total on the rubric.