An automation lets Qevlar apply a response to every alert in a pattern without an analyst deciding it again each time. Qevlar groups similar alerts into patterns, suggests the actions that fit each pattern, and measures how often analysts agreed with the verdict. Once you activate a pattern, each new alert that joins it gets its own response, with every action pointed at a target taken from that alert, and your SOAR reads that response from the API and executes it.
This page covers activating a pattern, the two response modes, and how the response reaches your SOAR. For how next steps are produced on a single alert, see Contextual Next Steps Recommendations.
Why it matters
- One decision per pattern. The actions are chosen once, on the pattern, and applied to every alert that joins afterwards. Analysts stop reviewing the same response on alerts the SOC has already handled many times.
- Targets come from the investigation. Each action is pointed at the user, host, domain or message the investigation identified in that alert, so nobody retypes an account name into a production tool.
- Guardrails fail closed. When Qevlar cannot name a safe target, or the alert involves a VIP, the response waits for an analyst even if the pattern runs automatically.
- Everything is recorded. Every decision, whether Qevlar made it or an analyst did, is written to the audit log of the alert.
- Your SOAR stays in charge of execution. Qevlar decides what to do and on which target; your SOAR runs the actions with the integrations it already has.
Where to find it
Platform UI. Open Automations in the left navigation, select a pattern and go to the Agent tab. The pattern page also shows the pattern definition, the number of investigations that matched it over the last four weeks and how often an analyst changed the verdict. When an alert belongs to a pattern that can be activated, its report offers the activation directly.
API. Your SOAR reads the response for an alert from the automation endpoint. See How your SOAR receives the response below.
Before you start
- Your SOAR reads the automation endpoint. Qevlar does not execute actions itself in this release. Your SOAR or workflow tool calls the automation endpoint for each alert and maps every action to the module that runs it.
- Your VIP list is up to date. The VIP guardrail reads the VIP users saved under Assets. An executive who is not on that list is treated like any other user.
- You have the role to activate. Activating, editing and pausing a pattern is reserved to administrators and managers. Analysts see the pattern page in read only mode and can approve or reject held responses.
Activating a pattern
- Open Automations and select a pattern. Only patterns with a Malicious or Benign verdict can be activated. Patterns that have never been activated show as Pending activation.
- Read the pattern strip: the definition, the investigations matched over the last four weeks and the verdict changes. This tells you how reliable the pattern has been before you let it act.
- On the Agent tab, review the suggested actions. Click an action card to read what it does. Switch off the actions you do not want and drag the others into the order they should run.
- Under Response execution, choose Supervised or Automated. See Response execution modes below. The panel also shows the payload your SOAR will receive.
- Click Apply changes. The agent is live on the pattern, and the Automations list shows it as Active.
Activation is not retroactive. Alerts that were already in the pattern keep the next steps they had. Only alerts that join after activation get an automated response.
Response execution modes
| Mode | What happens to each new alert | Who can set it |
|---|---|---|
| Supervised | Qevlar prepares every action and holds it. Nothing is executed until an analyst approves either on Qevlar or in the SOAR. | Administrator, Manager |
| Automated | Qevlar sends every action to your SOAR as soon as an alert matches the pattern, specifying the automatic execution. | Administrator, Manager |
You can move a pattern straight to Automated. Nothing in the product forces a period in Supervised first, although starting there is the usual choice.
What happens when an alert joins an activated pattern
- Qevlar investigates the alert and places it in the pattern.
- Qevlar builds the response for that alert from the pattern's actions and resolves a target for each action: the user to notify, the domain to block, the message to remove.
- Qevlar checks the guardrails, in this order:
- Unresolved target. An action has no safe target in this alert. The response is held.
- VIP. The alert involves a user on your VIP list. The response is held.
- Supervised mode. The pattern is in Supervised mode. The response is held.
- If no guardrail applies and the pattern is in Automated mode, Qevlar approves the response and serves it to your SOAR.
How your SOAR receives the response
Your SOAR calls the automation endpoint for an alert and receives the response: each action, its target and its decision. A response that is still waiting for approval is returned as pending, so your workflow knows to wait or to route it to an analyst. While Qevlar is still placing the alert in its pattern, the endpoint answers 202 and your SOAR should retry.