The agent identifies active security incidents, assesses their severity, and executes containment protocols to isolate affected agents or systems, ensuring immediate risk mitigation.
The agent first queries the ATC (Agent Traffic Control) system to retrieve raw signals and incident overviews using tools like get_atc_signals and get_atc_overview. It then uses triage_incident to formally log and categorize the threat. If the incident requires immediate action, the agent executes contain_incident to halt or restrict the compromised agent's access, preventing further damage. The agent verifies the containment status before reporting completion.
- Category: Operations and infrastructure
- Effect: Changes data in your accounts
- MCP servers: ALEETH Authority MCP (https://koskamo.com/explore/aleeth-authority-mcp)
- Source: ALEETH Authority MCP (https://mcp.aleeth.com/)
- Source quote: "triage_incident Triage Incident incident:manage prepare contain_incident Contain Incident incident:manage prepare"
- Playbook page: https://koskamo.com/explore/use-cases/triage-and-contain-security-incidents
Prompt: Check for any active security incidents in the ATC system. If there are critical signals, triage the incident and immediately contain the affected agent to prevent further risk.