Triage and Contain Security Incidents
The agent identifies active security incidents, assesses their severity, and executes containment protocols to isolate affected agents or systems, ensuring immediate risk mitigation.
How it works
The agent first queries the ATC (Agent Traffic Control) system to retrieve raw signals and incident overviews using tools like get_atc_signals and get_atc_overview. It then uses triage_incident to formally log and categorize the threat. If the incident requires immediate action, the agent executes contain_incident to halt or restrict the compromised agent's access, preventing further damage. The agent verifies the containment status before reporting completion.
Prompt
Paste this into an agent that has the servers below connected. Adjust the names and dates to your own.
Check for any active security incidents in the ATC system. If there are critical signals, triage the incident and immediately contain the affected agent to prevent further risk.MCP servers it needs
Source
The vendor page this playbook is drawn from, and the passage that supports it.
triage_incident Triage Incident incident:manage prepare contain_incident Contain Incident incident:manage prepareALEETH Authority MCP