Approval by default: how SARA proposes, and a person decides
SARA investigates and proposes a response. Response actions wait for approval by default, each request covers one queued action, and a decision stands once it is made.
By the SIRP team
There are two very different kinds of work in a SOC, and most of the argument about autonomy comes from treating them as one.
The first is investigation: reading the alert, pulling context, checking history, weighing evidence, and arriving at a view of what is happening. It is slow, repetitive, and the reason queues grow.
The second is response: containing a host, disabling an account, blocking a hash. It changes things in your environment, and its consequences land on real people and real systems.
OmniSense treats them differently on purpose.
SARA does the investigation
SARA, the Co-Analyst inside OmniSense, triages and investigates on its own. It gives the analyst the evidence and a proposed response to review.
That changes what the analyst's time is spent on. They are no longer assembling a case from a blank page. They are reviewing one, and deciding.
A person decides the response
Response actions wait for approval by default.
When SARA proposes containing a host, the default is to put that response action in the queue for a person to approve or reject.
One request, one action
Each approval request refers to one queued action.
That sounds like a detail. It is not. An approval that covers "the response to this incident" invites the approver to say yes to a bundle they have only half read. An approval that covers "contain this host" is a question a person can actually answer.
It also keeps the history clear. When someone asks later why a host went offline, the answer is one action, one request, and one decision, not a batch that happened to include it.
A decision stands
Decided requests can't be re-decided.
Once a request is approved or rejected, it is closed. If circumstances change, the right move is a new proposal with the new evidence attached, and a new decision on it. The earlier decision stays what it was.
This matters most on a bad day. During an incident, people change their minds quickly and for good reasons. A system that lets a decision be quietly flipped after the fact makes it very hard to reconstruct what anyone actually knew and chose at the time. A system that requires a fresh decision keeps that history readable.
Why we start here
Some will read approval by default as a lack of ambition. We read it the other way.
An agent that acts on your systems should earn that trust case by case. Reviewing the evidence behind each proposal gives analysts a way to judge where SARA's recommendations hold up.
What makes approval workable at all is the investigation that comes before it. When the case arrives complete, approval becomes a quick check, not a queue.
What this looks like in practice
Suppose SARA proposes containing a host and blocking a file hash. Those are two queued actions. Under the default policy, each gets its own approval request so the analyst can decide on each proposal separately.
That is the pattern, end to end: the investigation is SARA's, and the decision is yours.
SIRP builds OmniSense, a Self-Driving SOC. To see how SARA investigates, visit the SARA page or talk to us.