The "War-Room Orchestrator HyperAgent" workflow template is designed to streamline incident response for confirmed true positive security cases. When a case is resolved as "True positive - malicious," this workflow automatically creates a dedicated Slack incident response channel, gathers full case context, and queries for on-call personnel. It posts a structured incident summary with actionable recommendations, ensuring rapid coordination and communication among responders.
Optional Triggers
["It could be triggered from a QuickAction for an accelerated escalation."]
Use Cases
Case Management
Workflow Breakdown
Triggers when a Case transitions to RESOLVED with resolution "True positive - malicious"
HyperAgent fetches full case context (details, observables, attachments, timeline, notes)
Queries the responders table for on-call personnel.
Creates dedicated Slack IR channel (ir-case-[id])
Posts structured Block Kit incident summary with the collected case data and actionable recommendation
Vendors
Utils
Workflow Output
Fully provisioned Slack war room with context, responders added, and summary pinned, within seconds of true positive confirmation.
Tips