1-SEC
Workflow & DevSecOps1 min read

Updated

Incident Triage with the 1-SEC CLI

Start from an alert ID, host, source event, timestamp, and process/file context. Preserve evidence before destructive response.

1S

1-SEC contributors

CLI automationincident responsesecurity scriptingautomation1-SEC CLISOC triagerapid response

The operational task

Start from an alert ID, host, source event, timestamp, and process/file context. Preserve evidence before destructive response.

What the implementation supports

The CLI retrieves structured alerts and exposes enforcement policy/history. Use the installed release's JSON flags and keep response authorization separate from alert retrieval.

Integration and limits

Reading alerts does not isolate a cloud network. Confirm the actual action adapter, permissions, target, dry-run state, and recovery procedure before executing a response.

Check collector wiring, the current event schema, and the enforcing component before relying on a response. Preserve the original event and verify the result on your actual deployment. An emitted alert does not prove that the initiating operation was stopped.

Sources and implementation

Continue Reading

DevSecOps

Why Security Teams Are Switching to CLI-First Tools

Dashboard fatigue is pushing security teams toward CLI-first tooling. Learn how command-line security tools integrate with CI/CD pipelines, scripts, and automation for faster incident response.

Incident Analysis

Polymarket, Binance and the Limits of a Security Agent

The October incidents raise practical questions about third-party scripts, signing authority and where a security agent can help.

Threat Intelligence

v0.4.29: Safer Automatic Response, Clearer Limits

1-SEC now keeps capacity warnings separate from attack evidence, protects victim files from automatic quarantine, and prevents aggregate traffic alerts from targeting an incidental process. The update also bounds detector state and protects large byte counts.

← Browse all 103 articles

Try 1-SEC Today

Open source, single binary, 16 security modules. Download and run in under 60 seconds.

View on GitHubRead the Docs