Skip to content
AI Cyber Compare

LESSON 7 OF 10 · SIZING · 3 MIN READ

Build a response action catalog: which actions may run without a person

The short answer

A response action catalog lists every action your SOC takes, its blast radius, and the approval it needs by day and by night. It turns a vague question (how much autonomy?) into a list of yes or no decisions, and it works the same whether the actor is a playbook, an agent or a provider.

By The Triage Desk · AI Cyber Compare · Published 2026-10-08

Why a catalog?

Debates about autonomy stall because they are abstract. A catalog makes them concrete: instead of asking whether software should act alone, you ask whether software may reset this password at 2 a.m. without a person. Most teams find they agree quickly on individual actions.

What goes in each row?

  1. The action, by name: disable account, revoke session, reset password, isolate host, block hash, quarantine email, block domain.
  2. The tool that performs it.
  3. The blast radius: one user, one host, many users, production systems.
  4. Reversibility: can it be undone in minutes?
  5. Approval by day, approval by night: none, one analyst, a named lead, or wait until morning.

How do you set the approval levels?

Start from blast radius and reversibility. Quarantining a single phishing email is narrow and reversible. Isolating a production database server is wide and hard to reverse. A common pattern is to let software act alone on narrow, reversible actions for trusted alert categories, require one approval for single-user or single-host actions, and require a named lead for anything wider.

How do products map to the catalog?

Vendors describe their controls in different terms, and the catalog lets you translate them:

  • Mate Security describes three modes: Recommend only, Supervised (low-risk steps run, risky changes need approval) and Auto-run for trusted categories under guardrails and audit.
  • Prophet Security describes scoped Agent Actions that run autonomously or with your sign-off.
  • Cortex AgentiX agents act within existing roles and permissions and can require approval for high-impact actions, according to Palo Alto.
  • 7AI describes actions such as revoking a session, resetting a password or isolating a host behind approval gates with a full audit trail.

Ask each vendor to fill in your catalog's approval columns with its own settings. If it cannot express a row, you have found a gap.

How do you pull autonomy back?

Add one more column: what happens when the actor gets it wrong. You want a way to drop an action back to approval-required quickly, and a record of what ran. Mate Security, for example, describes rolling back to Supervised when verdicts drift from analyst reviews. Whatever the product, test the pull-back in a pilot, not in an incident.

How often should you revisit the catalog?

Every quarter, and after any incident in which an action ran when it should not have, or waited when it should have run. Each review should move a few rows: narrow, reversible actions that have run cleanly for months can move toward less approval, and anything that caused trouble moves back. Keep the history of changes; auditors and new team members will ask why an action is allowed.

Words in this lesson: Response action, Response action catalog, Playbook, Alert, Cortex AgentiX

Sources

Source: Mate Security platform page · Read 27 Sep 2026

Source: Prophet Security homepage · Read 27 Sep 2026

Source: Palo Alto Networks: Cortex AgentiX · Read 27 Sep 2026

Source: 7AI: response · Read 27 Sep 2026

Next lessonRunning an AI SOC platform by day and a provider by nightMany teams run their own AI SOC platform by day and a provider overnight. How to split the work, what to agree in writing, and the failure points to watch.

Read next

Staffing and coverageEach SOC operating model needs a different kind of staffing. Who must be awake, who approves actions and who maintains the system, model by model.Fit finderFive questions that order the models by your answers.Asked oftenShort answers to common SOC model questions.