CYBRARY Autonomous Responder
Leadership wants an agent that isolates endpoints automatically at 3am. Configure it so it is genuinely useful on true positives and survivable on false positives — then prove both with the suites.
Change request CR-901 — 'enable auto-isolation for high-severity detections'
SOC lead
Detection engineer
Ops
65 minutes · expert
Execution trace
00:00:00alertEDR
High-severity detection on a finance workstation
Credential-dumping signature, 02:41, no analyst on shift.
00:00:05modelresponse-agent@2026.05
attack step
Agent plans isolation
Single detection, no corroboration required by the current config.
00:00:08tooltool-broker → edr.isolate
Host isolated
Correct call this time — the detection was a true positive.
00:10:00alertEDR
attack step
Same rule fires on 38 hosts
A signature update misfires fleet-wide; the same config would isolate all of them.