Detections & Response

SL-05

What the platform did automatically, and how quickly. Detection without response is a report; the value is in the seconds between the anomaly firing and the session being terminated.

DischargesS.8(4)R.6

Automated responses

Sessions terminated

Accounts suspended

Escalated to Breach Response

Response mix

Proportionality matters — not every anomaly warrants suspension.

Session terminated2
Account suspended1
Just-in-time access revoked1

Available response actions

Configured per playbook and escalated progressively. Warn, then restrict, then suspend — jumping straight to suspension on a moderate-confidence signal creates outages that get the control switched off.

Session terminated
Active sessions are killed immediately. The fastest way to stop an in-progress extraction.
2
Account suspended
The identity is disabled entirely. Used where the credential itself is assumed compromised.
1
Access throttled
Request rate is limited rather than blocked. Preserves service where a false positive would be costly.
0
Just-in-time access revoked
Just-in-time elevation is withdrawn early, returning the identity to standing permissions.
1
Step-up authentication required
Step-up authentication is required before the next action. Proportionate where confidence is moderate.
0
SOC notified
Routed to the security operations centre without automated enforcement.
0

4 responses


AAN-2026-0912	svc_scheme_sync Access from an unusual location	Account suspended	Critical	Critical	escalated	2 days ago
AAN-2026-0913	svc_scheme_sync Sudden volume of personal data accessed	Session terminated	Critical	Critical	escalated	yesterday
AAN-2026-0876	Kavya Malik Access outside business role or purpose	Session terminated	Critical	Low	contained	13 days ago
AAN-2026-0912	svc_scheme_sync_20 Lateral movement attempt	Just-in-time access revoked	High	High	contained	2 days ago

Evidences:S.8(4)R.6Rule 6 requires measures to detect unauthorised access and to take remedial action. An automated response with a timestamp is the cleanest form that evidence takes.