One incident record
Bring evidence, timeline, comments, communications, and reports together.
uSAFE INCIDENT MANAGEMENT
From first alert to final report,
in one place.
Report, investigate, notify, and close security incidents in a single application, with built-in playbooks, SLA timers, evidence tracking, and AI that helps you write. People make the decisions.
A SHARED PICTURE UNDER PRESSURE
Keep the response together.
Clear ownership
Assign responsibility and monitor deadlines so work and overdue items stay visible.
A record you can explain
Capture decisions and evidence as you work, rather than rebuilding them when the report is due.
FROM ALERT TO LESSONS LEARNED
A structured response.
- 01
Report
Use a guided form or the emergency Under Attack? action. Likelihood and impact inform risk and suggested priority.
- 02
Respond
Assign an owner, follow status and SLA timers, and record the timeline and communications.
- 03
Investigate
Use a playbook with a Next Action, tool, log source, checklist, and evidence links.
- 04
Close and learn
Obtain required closure approval, publish the reviewed report, and capture lessons learned.
RESPONSE WORKSPACE
The work behind a defensible record.
Guided investigation
Suggested playbooks are applied by the analyst. Next Action guidance explains which configured tool and log to use, and why.
Evidence and custody
Record hashes, storage locations, and hand-offs. Uploaded evidence is stored privately.
Workflow and SLA timers
Track open incidents on a response board, assign owners, mention teammates, and monitor response and escalation timers.
Communications and obligations
Log notifications, send messages to saved contacts, and track regulatory notification due dates. Tracking an obligation does not establish compliance.
Final reports
Review an incident overview, timeline, indicators, and notifications alongside findings and recommendations. Publish Word, PDF, or text reports.
Preparation and improvement
Maintain playbooks, log lessons learned, and track tabletop exercises, drills, training, and remediation.
ASSISTANCE WITH HUMAN REVIEW
Drafts and suggestions. Your decisions.
Writing and report drafts
AI rewrites rough notes and drafts executive summaries, findings, and recommendations. People review, save, and publish.
Evidence analysis
AI describes screenshots and summarizes logs and documents for analyst review, separately from the formal evidence record.
Read-only Copilot
Ask questions using the incident’s data. The Copilot cannot change records, close incidents, or act on your systems.
ALERT IN · EVENT OUT
Connect through the API and signed webhooks.
Security toolsREST API → uSAFE incidentsSigned webhooks → your automation
CrowdStrike Falcon
Open incidents automatically using a Falcon Fusion workflow that calls the REST API. This connection is verified working in the supplied product brief.
Create and list incidents
API keys authorize incident creation and listing. Updating or closing incidents through the API is not available.
Events for your automation
Signed webhooks notify your systems when an incident is created, changes status, is assigned, or escalates. Chat delivery requires an automation tool.
ROLES & RESPONSIBILITY
Access that fits the response.
Viewer & User
Viewers read incidents and reports. Users can also raise incidents, comment, and record timeline entries and indicators.
Manager & Admin
Managers handle response work and publish reports. Admins also manage team access and settings. Serious closures require a separate approver.
Provider roles
MSSP Analysts perform response work. MSSP Managers can approve closures and publish; MSSP Admins also manage provider administration.
SECURITY & CONTROL
Protect access and preserve accountability.
Account protection
Authenticator-app MFA, recovery codes, lockout controls, and Microsoft sign-in where configured.
Separate client access
Organization data is isolated. Provider staff see only clients they have been granted.
Controlled closure and connections
High and Extreme closures need an Admin or Manager other than the assignee. API keys are hashed, scoped, rate-limited, and revocable; webhooks are signed.
VISIBILITY & REPORTING
Keep leadership and responders informed.
Operational metrics
Review open and critical incidents, SLA status, resolution time, volume, and response cost.
Communications record
Maintain declarations, daily reports, notification logs, and regulatory deadline tracking.
Provider portfolio
Review granted clients from one login, switch into the active tenant, and manage staff access per client.
YOUR QUESTIONS
Before you get started.
Does it replace an EDR or SIEM?
It coordinates the response. Your security tools detect; uSAFE records, assigns, and reports.
Does AI make response decisions?
No. AI drafts and summarizes for review. The Copilot is read-only and cannot act on systems.
Can we control incident closure?
Yes. Closing a High or Extreme incident requires an Admin or Manager other than the person assigned.
What can we export?
Final reports can be published as Word, PDF, or text, with additional declarations, daily reports, and data exports.
LET’S TALK ABOUT YOUR TEAM
See uSAFE Incident Management in action.
Tell us about your priorities and the workflows you want to explore.
uSAFE Callback Request