Security teams are drowning in alerts, not lacking tools. This piece walks through how a Ghost agent takes a single noisy alert and carries it to resolution.
Triage in seconds, not minutes
When an alert lands, the agent first establishes what it is looking at. It pulls the originating signal, the asset, and the identity involved, then scores the alert against the environment’s own baselines rather than a generic ruleset.
The result is a confidence-ranked starting point an on-call engineer would recognise — minus the half hour of manual context gathering.
Correlating across systems
A single alert rarely tells the whole story. The agent reaches into the surrounding systems — EDR, IdP, mail, cloud — and stitches the related events into one timeline, surfacing the sibling activity a coarser tool would miss.
Containment under your control
With the picture assembled, the agent proposes (or executes, at your chosen autonomy level) the containment steps: isolating a host, revoking a session, pulling a malicious message from every inbox it reached.
Crucially, that step is never a black box. The agent emits each containment action as a structured, auditable record, gated on the autonomy level you set for the use case:
import { agent, AutonomyLevel } from "@ghost/sdk";
// Gate the containment step on the customer's configured autonomy level.
const action = await agent.propose({
type: "isolate-host",
asset: alert.asset,
reason: alert.summary,
});
if (autonomyLevel >= AutonomyLevel.ActAndInform) {
await action.execute(); // T2+: act, then notify
} else {
await action.requestApproval(); // T1: surface it and wait for a human
}What the analyst is left with
Instead of a fire hose, the team gets a written investigation: what happened, why it matters, what was done, and what to verify. The work that advances the security posture stays human; the toil does not.