Cases and response

One incident. One story. Every action reversible.

When something happens, you do not want a list of alerts — you want to know what is going on and what to do. A case gathers the related signals into one chronology and offers a bounded action you can undo.

Operational viewIllustrative flow. No customer data.
What the current evidence supports

No action is open-ended. Each one covers named pages only, expires on its own, and keeps a rehearsed way back. Sensitive decisions ask for a second identity check first.

01

What you can see and control

Every capability has a narrow responsibility, an operational state and evidence that explains the result.

01

The whole story in one place

Traffic, software, identity and recovery evidence live on the same record, in the order it happened, with who decided what.

Available
02

Rules automation cannot break

Each service declares which pages must never be blocked, how far an automatic action may go, who must approve it, and what happens when a check is inconclusive.

Available
03

Undo is a first-class button

Every applied control shows its remaining time and a one-click rollback (returning to the state from before).

Unavailable
02

How you use it in an operating workflow

The visitor path remains short. Configuration, verification and rollback stay visible to the operator at every stage.

Fast request pathAnalyse en parallèleEvidence before promotion
  1. 01

    Group the signals

    Related events become one case instead of dozens of separate alerts.

  2. 02

    Propose something small

    The proposal names the exact pages it touches and the time after which it disappears.

  3. 03

    Keep or undo

    You decide, with the health checks visible next to the decision.

03

The interface explains what is known, unknown and required

AegiFlow does not turn missing evidence into a reassuring zero. Every state links to its source, freshness and next action.

State
Available, observation, configuration required, degraded, unavailable or planned.
Evidence
Source, timestamp, scope and last successful verification.
Action
The responsible party, exact change and expected impact.
Way back
Rollback instructions are defined before an active change.
04

In depth

How this capability behaves in production — grounded in the platform's documented, current operation.

Cases, because nobody triages four hundred alerts

Related traffic signals, inventory findings and recovery events are correlated into one case with one timeline. You see what happened, what AegiFlow proposed, what a human decided and what the outcome was — in order, with evidence attached.

Response with a scope, a clock and step-up approval

A containment control is bounded to specific routes and fingerprints, carries a TTL that expires on its own, and requires fresh multi-factor step-up before a human keeps or extends it. The safety contract of each service defines what automation may never exceed.

Start in observation. Activate only measured controls.

Ownership, certificate, origin health and rollback must pass before traffic protection changes.

See reversible response