Automated triage for phishing alerts — extracts IOCs, checks reputation, and escalates confirmed threats.

Isolates a compromised endpoint via EDR API, creates a case, and notifies the IR channel.

Responds to suspicious identity events — resets credentials, revokes sessions, and enriches with threat intel.