Scorecard method: how 25 actions were read
What the containment coverage scorecard answers, the four statuses, which pages were read for each platform, and what the scorecard does not measure.
Read dates
Read dates: 2026-11-03 for Cortex XSOAR, Splunk SOAR, Swimlane, Torq, Tines and Blink Ops; 2026-11-04 for every other platform and for the time-to-contain evidence. Next refresh: quarterly, first due 2027-02-03.
What the scorecard answers
For each platform, which containment actions does the vendor's own documentation show it can take against a named target system, across EDR, identity, email, cloud and network. It answers "is this action documented", not "does it work well".
The four statuses
- Native. A vendor-maintained integration, built-in action, or vendor-published template documents this exact action against a named target. Examples: a Cortex XSOAR content pack supported by Palo Alto Networks, a Splunk-published SOAR app, a Tines pre-built action template, a Torq workflow template, a D3 integration page.
- Partner. The action is documented only by a third party, a community project, or the target vendor's own app rather than the platform vendor, or only as a proxy for another product. Examples: a Splunk SOAR app published by SentinelOne or VMware; ThreatConnect's NetWitness proxy for CrowdStrike isolation.
- Custom. The only documented route is a generic HTTP, CLI or script step on the target. Used sparingly: a cell is marked custom only where the platform's docs show such a step for that target (Blink's AWS CLI script step, Blink's Mimecast custom action). Every platform can call an API, so "custom" is never assumed.
- Not documented. The pages read do not document the action. It may exist. Where a platform documents the integration but not the specific action, the cell is not documented, never native.
Where a page said an action exists but named no target system (for example Prophet's "quarantining a machine"), the cell is not documented and the note says so.
How the docs were read
Primary documentation only: the integration or action pages, not marketing pages. Sources by platform:
| Platform | What was read |
|---|---|
| Cortex XSOAR | Command lists in the integration README files of the content packs on GitHub, the source of the marketplace and docs pages; support level from each pack's metadata (xsoar read as native, partner as partner) |
| Splunk SOAR | Action lists in the connector repository README files (the source of Splunkbase pages); publisher field decides native or partner |
| Swimlane | Capability sections on docs.swimlane.com connector pages (the marketplace site is script-rendered) |
| Torq | Knowledge base integration articles and published workflow templates |
| Tines | Pre-built action template lists per tool and library stories; lists page client-side, so they were paged through with a headless browser |
| D3 Security | Command and permission tables on docs.d3security.com |
| Google SecOps | SOAR marketplace integration pages on cloud.google.com |
| Microsoft Sentinel | Microsoft Learn Logic Apps connector pages and playbook templates in the Azure-Sentinel repository |
| ServiceNow | Integration Hub spoke pages (Xanadu) |
| Blink Ops | Per-integration action lists and action pages on docs.blinkops.com |
| Cyware | Orchestrate integration pages on techdocs.cyware.com |
| ThreatConnect | Knowledge base integration articles |
| Revelstoke (Arctic Wolf) | Arctic Wolf press release and blog; no product docs public |
| CrowdStrike Falcon Fusion | Public CrowdStrike pages; the action catalogue is behind the Falcon login |
| Exabeam | Automation Management and Incident Responder service pages |
| Dropzone, Prophet, Mate | Their documentation, integration catalogue and product pages |
Every cell carries the URL of the page read and the read date. Cells with several named targets carry the first page as docs_url and the others as extra_urls.
Representative targets were read for each domain, not every integration a platform ships. A cell that says "not documented" means the pages we read for that action's usual targets did not show it. Platforms with long catalogues can score higher than the same product would on a full read.
Why these 25 actions
They are the actions an incident responder reaches for first when stopping spread: isolate and release a host, stop a process or file, disable and re-credential an account, pull a delivered phish, cut cloud access, block at the network. They cover the five places an attack can be contained: endpoint, identity, email, cloud and network. Each has at least two typical targets, so a platform can be scored on a capability rather than on one vendor's product.
The email domain lists delete and quarantine as two separate actions, which brings the catalogue to 25. No platform was found to document a distinct quarantine of an already delivered message, so that column is empty and is the least informative of the 25.
How the coverage share is computed
Coverage share = (native + partner) / 25, shown as a percentage to one decimal place. Custom and not documented count as zero. The four counts per platform are in scorecard.json. The share is a measure of documented breadth, not of quality or depth, and a platform that reads as 0 percent may still be able to take actions that its public pages do not show.
What the scorecard does not measure
- Whether an action works well, how fast it runs, or how reliably.
- Quality of approval workflows, human-in-the-loop controls, rollback, or audit trails.
- Whether the integration is current. Several pages carry old "last updated" dates (Exabeam Incident Responder pages are from 2022).
- Whether a customer has licensed or configured the integration.
- The accuracy of investigations that lead up to containment.
- Time to contain. Published time-to-contain figures are listed separately in
evidence.json, graded A to D, and none reaches B.
Platforms that were hard to read
- ServiceNow Security Operations. The docs portal and the Store are script-rendered. Only Integration Hub spoke pages returned text; Security Operations integration pages did not. The row understates capability.
- ThreatConnect. The marketplace that lists playbook app actions failed with a TLS handshake error. No certificate check was bypassed. The row understates capability.
- CrowdStrike Falcon Fusion. The Falcon documentation portal sits behind a login. The public site names no Fusion action. The row reads 0 of 25 and understates capability.
- Revelstoke. The product's own domains no longer resolve; Arctic Wolf acquired it (intent announced 2023-10-10) and publishes no action docs.
Corrections
Vendors can send corrections with the page URL that documents the action, to editor@timetocontain.com (see the corrections page). A correction that points to a public page changes the cell and the date. A correction with no public page is recorded in the cell's note but does not change the status. Any change is logged on the Corrections page with its date.
Refresh
Read 2026-11-03 and 2026-11-04. The scorecard is re-read quarterly and after any vendor announces a large integration or action release.
25actions, five domains
The 25 actions
- Isolate host (EDR)
- Cut a managed endpoint off from the network while keeping the sensor channel to the EDR console open, so analysts can still investigate. Typical targets: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Cortex XDR, Carbon Black.
- Release isolation (EDR)
- Lift a network isolation placed earlier, returning the endpoint to normal connectivity. Typical targets: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne, Cortex XDR, Carbon Black.
- Kill process (EDR)
- Terminate a named running process on an endpoint, by PID or name, from the response console or API. Typical targets: CrowdStrike Falcon (Real Time Response), SentinelOne, Cortex XDR, Carbon Black.
- Quarantine file (EDR)
- Move a file on disk to the EDR quarantine store so it cannot execute, without deleting the evidence. Typical targets: Microsoft Defender for Endpoint, Cortex XDR, CrowdStrike Falcon, SentinelOne.
- Run script or live response (EDR)
- Execute a script or live response command on an endpoint to collect evidence or remediate. Typical targets: CrowdStrike Falcon (RTR), Microsoft Defender for Endpoint (live response), SentinelOne (remote script), Cortex XDR.
- Block hash (EDR)
- Add a file hash to the EDR blocklist or custom indicator list so it is prevented from running across the estate. Typical targets: CrowdStrike Falcon (custom IOC), Microsoft Defender for Endpoint (indicators), SentinelOne (blocklist), Cortex XDR (block list).
- Disable user (Identity)
- Disable, suspend or deactivate a user account in the identity provider so no new sign-in succeeds. Typical targets: Okta, Microsoft Entra ID, Google Workspace, Active Directory.
- Force password reset (Identity)
- Invalidate the current credential and require a new password at next sign-in. Typical targets: Okta, Microsoft Entra ID, Google Workspace, Active Directory.
- Revoke sessions or tokens (Identity)
- End active sessions and revoke refresh or access tokens for a user. Typical targets: Okta, Microsoft Entra ID, Google Workspace.
- Require MFA re-enrolment (Identity)
- Reset or delete a user's registered MFA factors so the user must enrol again. Typical targets: Okta (reset factors), Microsoft Entra ID (delete authentication methods), AWS IAM (deactivate MFA device).
- Remove from group or role (Identity)
- Remove a user from a security group or revoke a role assignment to cut inherited access. Typical targets: Okta, Microsoft Entra ID, Active Directory, Google Workspace, AWS IAM.
- Delete a delivered message (Email)
- Remove a delivered phishing message from user mailboxes, from one mailbox or across many, by message ID, sender or search. Typical targets: Microsoft Exchange Online, Gmail, Mimecast (remediation incident), Microsoft Defender for Office 365, Microsoft Purview.
- Quarantine a delivered message (Email)
- Move an already delivered message into the administrator quarantine, instead of deleting it, so it can be reviewed or restored. Typical targets: Microsoft Defender for Office 365, Mimecast, Proofpoint, Cisco Secure Email.
- Block sender or domain (Email)
- Add a sender address or domain to the gateway blocklist so later mail is rejected or quarantined. Typical targets: Mimecast, Microsoft Defender for Office 365, Exchange Online, Cisco Secure Email, Proofpoint.
- Remove a URL rewrite exemption (Email)
- Delete a URL from the permit or bypass list of the email gateway's URL rewriting and click protection, so it is scanned again. Typical targets: Mimecast (managed URLs), Proofpoint URL Defense, Microsoft Defender for Office 365 (Safe Links).
- Pull from quarantine (Email)
- Release a held or quarantined message back to the recipient after review. Typical targets: Mimecast, Microsoft Defender for Office 365, Proofpoint Protection Server, Cisco Secure Email.
- Disable IAM user or access key (Cloud)
- Disable a cloud IAM user, login profile, service account or access key. Typical targets: AWS IAM, Google Cloud IAM, Azure RBAC.
- Revoke cloud session (Cloud)
- Invalidate active cloud sessions or temporary credentials issued to a principal. Typical targets: AWS IAM (role session revocation), Google Cloud IAM, Azure.
- Isolate or stop an instance (Cloud)
- Stop, power off or network-isolate a compute instance. Typical targets: AWS EC2, Azure Virtual Machines, Google Compute Engine.
- Change a security group or firewall rule (Cloud)
- Add or remove a rule in a cloud security group, network security group or cloud firewall. Typical targets: AWS EC2 security groups, Azure network security groups, Google Cloud firewall.
- Revoke OAuth app consent (Cloud)
- Remove a delegated consent grant or enterprise application so a third-party OAuth app loses access. Typical targets: Microsoft Entra ID (OAuth2 permission grants, service principals), Google Workspace, Okta.
- Block IP or domain at the firewall (Network)
- Add an IP address, FQDN or URL to a firewall blocklist, address group or deny rule. Typical targets: Palo Alto Networks PAN-OS and Panorama, Fortinet FortiGate, Check Point, Cisco Firepower.
- Block at the proxy or DNS filter (Network)
- Add a URL or domain to a secure web gateway denylist or DNS filter block list. Typical targets: Zscaler Internet Access, Cisco Umbrella, Netskope, Cloudflare Gateway.
- Disable a switch port or NAC quarantine (Network)
- Quarantine an endpoint through network access control, or disable its switch port, so it loses network access. Typical targets: Cisco ISE, Aruba ClearPass, Forescout, Cisco Meraki.
- Add to a threat list on the NDR (Network)
- Add an indicator or entity to a watchlist, blocklist or intel feed on a network detection and response tool. Typical targets: Darktrace, Vectra, ExtraHop Reveal(x), Cisco Secure Cloud Analytics.
Back to the scorecard.