confirm-action

Ask the user a confirmation question before proceeding with a significant action.

Inputs

• QUESTION_TEXT - The specific question to ask (e.g., "Isolate endpoint WORKSTATION-01?", "Proceed with account disable for jsmith?")
• (Optional) RESPONSE_OPTIONS - Predefined options for the user:
  • Default: ["Yes", "No"]
  • Custom examples: ["Disable Account", "Reset Password", "Monitor Only"]

Workflow

Step 1: Present Question

Display the question to the user with available options.

Step 2: Wait for Response

Collect the user's selection or custom input.

Step 3: Return Response

Provide the response back to the calling workflow for decision branching.

Outputs

| Output | Description | |--------|-------------| | USER_RESPONSE | The user's answer to the confirmation question |

When to Use

Always confirm before:

• Isolating/quarantining endpoints
• Disabling user accounts
• Blocking IPs/domains at firewall
• Terminating processes
• Deleting files
• Escalating to incident response
• Closing cases as false positive (for high-severity alerts)

May skip confirmation for:

• Adding comments to cases
• Running enrichment queries
• Generating reports
• Read-only operations

Example Confirmations

Containment:

Question: "Isolate endpoint WORKSTATION-01 from the network?"
Options: ["Yes - Isolate", "No - Continue Monitoring", "Escalate First"]

Account Action:

Question: "User jsmith shows signs of compromise. What action?"
Options: ["Disable Account", "Force Password Reset", "Monitor Only", "Escalate to IR"]

Case Closure:

Question: "Close case 1234 as False Positive?"
Options: ["Yes - Close FP", "No - Keep Open", "Escalate to Tier 2"]