Can it block things on its own?

No. Blocking an IP, disabling a user or isolating a host runs only after a human clicks Approve in chat. Containment also ships in dry-run mode, and it refuses internal IPs and protected accounts

Where is the incident record kept?

In n8n Data Tables on your own server, not in chat memory. The timeline, tasks, IOCs, hosts, accounts and phase are all stored there

Which incidents does it cover?

It ships with 8 playbooks: ransomware, business email compromise, compromised account, malware, data exfiltration, web compromise, insider threat and a generic one for everything else

No, IRIS is optional. When it is connected, the Commander creates the case after your approval and later pushes only what is new

Does it only work in Telegram?

No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in

Which AI model does it need?

An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google

How long does setup take?

About ten minutes with the one-command installer on Linux, macOS or Windows. It deploys n8n too if you need it

What if it is not for me?

You get a 7-day refund. If it does not fit your SOC, you get your money back

Your AI incident lead, running the response in your team chat

It declares the incident, loads the right playbook, keeps the timeline, scopes with Wazuh and writes the post-incident report. Containment and IRIS escalation wait for your Approve click

Incident Response Commander: $99.99, one-time. Product details

In an incident, the record is the first thing to fall apart

Before: Findings and decisions scattered across threads
Before: Tasks and owners tracked from memory
Before: The report rebuilt by hand after it is over
After: Timeline, tasks, IOCs, hosts and phase, logged as you talk
After: The right playbook loaded as tasks with due times
After: The post-incident report built from the record

An incident commander that never loses the thread

Declares the incident: Sets type and severity and loads one of 8 playbooks as a task list with due times
Keeps the record: Timestamped timeline, tasks with owners, IOCs, affected hosts and accounts, and the phase. Stored in n8n Data Tables, not chat memory
Scopes with Wazuh: "Where else did this IP, hash or user show up?" Alert counts, first and last seen, every agent involved and hosts not yet in the incident
Threat intel: IPs, domains and hashes checked with VirusTotal, AlienVault OTX and AbuseIPDB
Contains, with approval: Blocks an IP, disables a user or isolates a host through Wazuh Active Response, only after someone clicks Approve
Stakeholder updates: Plain-language drafts on cadence: critical every hour, high every 4 hours, medium every 24 hours
DFIR-IRIS escalation: Creates the case after approval, then pushes only what is new: IOCs, assets, timeline, tasks and status
Post-incident report: A branded HTML report with the timeline, tasks, IOCs and time to contain, delivered in your chat
Reminders: A schedule with no AI pages the team about overdue tasks, quiet incidents and updates that are due

One command, about ten minutes

Install: Run one command on Linux, macOS or Windows. It deploys n8n too if you need it
Connect: Add your AI model key, Wazuh and your chat app. Threat intel keys and DFIR-IRIS are optional
Respond: Tell it what happened. It declares the incident and gives you the first tasks

What you need

n8n: n8n 2.34 or newer with Agents and Data Tables, or let the installer deploy it
Wazuh: Wazuh 4.x indexer and manager API with read access. Active Response only if you enable containment
Chat app: Telegram, Slack, Discord or Linear. A Telegram bot takes a minute with @BotFather
AI model: An API key from any provider in the n8n Agent model picker
Optional: DFIR-IRIS 2.4+ and free VirusTotal, OTX and AbuseIPDB keys

Built to act only when you say so

Containment ships in dry-run mode, and every outward action waits for a human click

Facts come from tools: The model orchestrates and writes prose. Incident facts and reports come straight from the record
Approve before anything runs: Containment and IRIS escalation both wait for an Approve click in chat
Dry run by default: Containment ships with dry run on, so nothing is blocked until you switch it off
Never contains on a guess: It proposes containment only with evidence and refuses internal IPs, protected IPs and protected accounts
No raw queries: Chat text never reaches Wazuh as a raw query. Every filter is a typed clause
Private IPs stay private: Internal addresses are never sent to threat-intel services or to IRIS

What you get

10 tool workflows plus the reminder schedule
The agent with 12 skills: 8 playbooks, severity matrix, containment decision, stakeholder updates and the post-incident report
One-command installer for Linux, macOS and Windows
Setup guide and example conversations
Single-organization commercial license
7-day money-back guarantee

Common questions

Can it block things on its own?: No. Blocking an IP, disabling a user or isolating a host runs only after a human clicks Approve in chat. Containment also ships in dry-run mode, and it refuses internal IPs and protected accounts
Where is the incident record kept?: In n8n Data Tables on your own server, not in chat memory. The timeline, tasks, IOCs, hosts, accounts and phase are all stored there
Which incidents does it cover?: It ships with 8 playbooks: ransomware, business email compromise, compromised account, malware, data exfiltration, web compromise, insider threat and a generic one for everything else
Do I need DFIR-IRIS?: No, IRIS is optional. When it is connected, the Commander creates the case after your approval and later pushes only what is new
Does it only work in Telegram?: No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in
Which AI model does it need?: An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google
How long does setup take?: About ten minutes with the one-command installer on Linux, macOS or Windows. It deploys n8n too if you need it
What if it is not for me?: You get a 7-day refund. If it does not fit your SOC, you get your money back

All AI agents