Needs review
The queue of incidents waiting on a technician’s decision, with counters so you can see how much is waiting.
RESPONSE OPS · PLAYBOOKS
Incident response and approval-gated playbooks for MSPs
Response Ops is where incidents land in Command, split by who owns them so nothing is silently dropped. Playbooks take on routine work, and in advanced playbooks, the ones that can change an endpoint or an identity, each advanced step pauses for a person’s approval.
Command screenshot with sample data. Names are fictional.
- Split by who owns each incident
- Suppressing always needs a reason
- Advanced playbook steps wait for a person
- Your own AI provider, off per client by default
INCIDENTS
Every incident in one place, split by who owns it
Response Ops splits incidents into a needs-review queue, a view of what automation handled, and a full audit view, with counters so you can see what is waiting.
Handled by automation
What automation dealt with stays visible, so you can check its work instead of trusting it blind.
Full audit
An audit view of every incident and how it was handled, for governance and review.
Decisions with a reason
Open a ticket, suppress, or resolve. Suppressing always needs a written reason; for a ticket or a resolution, a note is optional.
PLAYBOOKS
Playbooks that pause for a person
Every playbook is authored against one of two action bands. A baseline playbook cannot change an endpoint or an identity. An advanced playbook can, and each advanced step pauses the run until a person approves it.
Baseline band
Baseline playbooks cannot change an endpoint or an identity, so they are the safe place to start automating.
Advanced band
Advanced playbooks can change endpoints and identities, and every advanced step stops for a person before it runs.
One approvals queue
Playbook approvals wait in the Approvals queue, alongside script, package, and workflow approvals.
- Run starts
- Advanced step reachedCan change an endpoint or identity
- Run pausesWaits in the Approvals queue
- Approved, then runsA person decided
EARNED TRUST
Shadow mode before you trust a playbook
Shadow mode records what a playbook would have decided next to what your technician decided, so you can see how often they agree before you trust it.
The shadow ledger
Each shadow run records what the playbook recommended and the facts it used. When a technician gives a verdict on the incident, the ledger marks the recommendation confirmed or overridden.
Only real verdicts count
A recommendation is scored against a person’s verdict. Bulk closes and board resets count as nothing.
Promote it once you trust it
Shadow mode is how you build that trust. Once you trust a playbook, you can promote it.
BRING YOUR OWN AI
Your own AI provider for triage
Playbooks and rules handle routine work without AI. For steps that need more reasoning, such as triaging an unusual alert or investigating an incident, Response Ops calls the AI provider you connect. You pay your provider directly; we charge nothing for AI.
Your provider, your key
Use Anthropic, OpenAI, Google, or a self-hosted model at an address you set. Your API key is encrypted at rest with AES-256-GCM.
Off until you switch it on
AI is off for each client until it is switched on for that client with consent.
Evidence kept separate
Deep investigation keeps the evidence, the AI’s assessment, and its suggestions in separate sections. Investigate shows how much evidence it covered and what was missing.
What it does not do
No AI path takes a privileged action. Investigation stands down on incidents more than an hour old and puts an unclear answer on hold.
ONE CONSOLE
Connects with the rest of Command
Sentry EDR and Web Protection
Endpoint protection and DNS filtering inside Aegis, on the same policy engine.
Service Desk (PSA)
Ticketing, todos, a shared calendar, and a knowledge base, with SOC and service work on one board.
Overwatch (RMM)
Monitoring, patching, jobs and automation, and remote control, under policies at every scope.
Integrations
Microsoft 365, Microsoft Defender, Google Workspace, QuickBooks, and your own AI provider.
Every Command module
Service delivery, endpoints, security, Microsoft 365, and documentation in one console.
INCLUDED IN THE ONE PRICE
$6 per endpoint per month, every module included
One price covers every Command module, including Sentry EDR and Web Protection. Unlimited technicians, month-to-month, and a free 30-day pilot on up to 50 endpoints.
FAQ
Response Ops and playbooks: common questions
Do playbooks run without approval?
A baseline playbook cannot change an endpoint or an identity. In an advanced playbook, each advanced step pauses the run until a person approves it.
What is shadow mode?
Shadow mode records what a playbook would have decided next to what your technician decided, and marks each recommendation confirmed or overridden, so you can see how often they agree before you trust it.
Does suppressing an incident need a reason?
Yes, always. For opening a ticket or resolving an incident, a note is optional.
Which AI providers can I use?
Anthropic, OpenAI, Google, or a self-hosted model. Your key is encrypted at rest, AI stays off for each client until it is switched on, and we charge nothing for AI.
Is Response Ops included in the price?
Yes. It is part of the one Command price of $6 per endpoint per month, with every other module, unlimited technicians, and no long-term contract.
See it in a walkthrough, or try it on your own endpoints
Book a demo for a guided tour, or apply for the beta to run Command free for 30 days with guided onboarding.