Workflow & DevSecOps10 min read

Automated Containment: Scripting Incident Response with the 1-SEC CLI

When every second counts, you need tools that work at the speed of the terminal. Learn how to build automated "triage and contain" scripts using 1-SEC.

1S

Incident Responder

CLI automationincident responsesecurity scriptingautomation1-SEC CLISOC triagerapid response

The Power of the Pipe

Security tools with only a GUI are a bottleneck. In 2026, the best responders live in the terminal. 1-SEC follows the Unix philosophy: do one thing well, and speak JSON so you can talk to everything else.

Building Your Automated War-Room

With 1-SEC, your incident response (IR) becomes a set of composable scripts.

One-Line Triage

`1sec alerts --severity CRITICAL --output json | jq` gives you an instant, machine-readable view of your most urgent threats. Pipe this into a script that automatically isolates the affected IP at the cloud-firewall level.

Custom Enrichment

Integrate with your threat-intel feeds. Take a blocked IP from 1-SEC, pipe it to an enrichment API, and post a full report to your internal Slack channel—all without a single human click.

Try 1-SEC Today

Open source, single binary, 16 security modules. Download and run in under 60 seconds.