#RSAC26CISO SafeSpace at RSAC26
Response & Recovery

One click. Every tool. Seconds to contain.

AI-recommended response actions across EDR, identity, cloud, and network, executed in a single click.

YouTube
Snowflake
Rubrik
Coupang
Supported by security leaders at 20+ enterprises across Europe and North America
0-click
Action execution
pre-staged, pre-populated, ready
<0s
Decision to action
from approval to execution across all tools
0+
Platform integrations
EDR, identity, cloud, network, email
0%
Human oversight
every action requires approval
The Problem

While analysts switch between tools, attackers keep moving.

By the time analysts finish switching tools, the attacker has already moved.

Attacker lateral movement complete at T+62m
Attacker
Initial Access14m
Priv. Escalation20m
Internal Recon18m
Lateral Move10m
Analyst
EDR
8m
SIEM
12m
Cloud
9m
IAM
6m
Network
7m
Intel
8m
M365
5m
ITSM
6m
Tickets
11m
SIEM 2
14m
62 min
attacker breakout time
CrowdStrike Global Threat Report 2024
86 min
analyst tool-switching time
Forrester TEI / SANS SOC Survey
24 min
attacker uncontested window
the gap — attack expands unchallenged

Source: CrowdStrike Global Threat Report 2024; Forrester TEI of Palo Alto XSOAR 2022; SANS SOC Survey 2023; IBM Cost of a Data Breach 2024

How It Works

From verdict to action in one motion

Malicious Behavior Prevention Alert: Memory Dumping via ddStatus:Human HandoffSeverity:HighConfidence:85%Priority:High (76)76Autopilot SummaryCoordinated credential dumping attack on ubuntu-s-2vcpu-4gb.dd command extracted process memory — MITRE T1003.007referenced. All behaviors blocked by Elastic Defend EDR.No lateral movement or credential exposure detected.View Reasoning →Autopilot ConclusionCoordinated credential dumping chain — 9 correlated alerts.Human verification required. Red team / pen test activitycannot be ruled out. Assess potential credential exposure.Activity HubClose AlertAAAlaris AdminRan 8 Instant Actions07:46Analysis AgentAssigned User00:48Unified Security GraphReceived Alert00:40Alaris Endpoint SecurityCreated Alert00:37… 1 more updateExpand History|See detailsActivity Hub·Status: Human Handoff·Assigned: AA·8 Actions ranClose Alert
01

All Data Unified

EDR, identity, cloud, network & email
All events in a single workbench view
Full attack story with entity mapping
Instant ActionsAI Generated
Isolate host WKSTN-0247
Execute
Revoke session tokens — john.admin
Execute
Block outbound port 4444
Execute
02

Instant Actions Pre-Staged

Context-aware actions, no copy-paste
Exact parameters pre-populated
Isolate, revoke, block, quarantine — ready
4 of 4 Actions CompleteAll systems contained in 1.6 secondsIsolate host endpoint-010.3sRevoke session tokens john.doe0.7sBlock IP range 185.220.101.x0.4sQuarantine email thread mktg-010.2sInvestigation workspace opened — endpoint-01
03

One Click, Work Begins

All systems contained in seconds
Investigation workspace opens automatically
Full audit log captured, no documentation needed
Core Capabilities

Response that matches the threat

AI Recommended Actions
Isolate host WKSTN-0247
Source:EDR·Severity:Critical
Execute
Revoke session tokens — john.admin
Source:Identity·Severity:High
Execute
Block outbound port 4444
Source:Network·Severity:High
Execute

AI-Recommended Actions

Context-aware actions, pre-populated and ready.

Response recommendations derived directly from agent investigation findings, the right actions with the right parameters, ranked by impact and urgency. No analyst has to decide what to do or configure how to do it.

Execution Status
Host IsolatedComplete
CrowdStrike EDR · Okta Identity·Completed:2026-02-17 07:46·Severity:Critical
Session RevokedComplete
Okta Identity·Completed:2026-02-17 07:46·Severity:High
Blocking C2 TrafficExecuting
Palo Alto FW·Completed:2026-02-17 07:45·Severity:Medium
Emails Purge QueuedPending
M365 Email·Completed:N/A·Severity:Low

One-Click Execution

Execute across every tool without switching consoles.

Every action arrives pre-staged and pre-populated with the exact parameters from agent analysis. Review, approve, and execute in a single click. The action runs across all relevant systems simultaneously.

Connected
CrowdStrike Falcon
CrowdStrike Falcon
EDR• Connected
SentinelOne
SentinelOne
EDR• Connected
AWS Security Hub
AWS Security Hub
Cloud• Connected
Microsoft Defender
Microsoft Defender
Cloud• Connected
_
Integration Configuration
Read Access
agents can read alerts/logs
Write Access
agents can execute actions
Agent Permissions
define per-agent action scope
Changes apply immediately to all connected agents

Unified Response Console

50+ integrations, one workflow.

Execute across EDR, identity providers, cloud environments, network devices, and email, all from a single interface. No tool-switching, no copy-pasting IOCs, no remembering which tool handles which asset type.

Audit Trail - Auto-Generated
14:22:47Marcus WebberSuccess
Host isolated
Systems: CrowdStrike
Actions: 8 executed
Created: 2026-02-17 07:46
14:22:49Lena BauerSuccess
Credentials revoked
Systems: Okta, Azure AD
Actions: 5 executed
Created: 2026-02-17 07:47
14:22:51Marcus WebberSuccess
C2 IPs blocked
Systems: Palo Alto
Actions: 12 executed
Created: 2026-02-17 07:48
14:22:53Lena BauerSuccess
Emails purged
Systems: M365
Actions: 3 executed
Created: 2026-02-17 07:49

Full Audit Trail

Every action documented automatically.

Every response action is logged with who approved it, what was executed, when it happened, and the agent reasoning behind the recommendation. Regulatory submissions are completed in minutes, not hours of post-incident reconstruction.

Watch Alaris contain across 6 systems in under a minute.

Live demo of one-click response. No slides, no theory.

Watch Live Demo
Why Alaris

The gap SOAR playbooks never closed

Legacy SOAR tools automate playbooks. Alaris automates the investigation, stages the response, and executes it. That is a different category.

Time to execute containment
Alaris Security
Seconds from approval
Manual Process
15-30 min, tool-by-tool
Legacy SOAR
Playbook execution, still slow
Tool coverage
Alaris Security
50+ platforms unified
Manual Process
5+ separate consoles
Legacy SOAR
Limited pre-built integrations
Action parameters
Alaris Security
Pre-populated from AI analysis
Manual Process
Manual copy-paste from investigation
Legacy SOAR
Static playbook values
Audit trail
Alaris Security
Automatic, complete, regulatory-ready
Manual Process
Manual post-incident reconstruction
Legacy SOAR
Partial logging
Human oversight
Alaris Security
Always required, never a bottleneck
Manual Process
100% manual, bottleneck
Legacy SOAR
Approval workflows vary
Adapts to incident context
Alaris Security
AI-recommended per investigation
Manual Process
Analyst judgment required
Legacy SOAR
Fixed playbook logic

The next breach ends in seconds, not hours