ContainIQ

ContainIQ is a web app (with optional Slack/Teams integration) that helps incident responders choose and execute containment actions safely under pressure. It ingests high-level signals from your SIEM/EDR (alerts, hostnames, user accounts, process hashes) and guides responders through risk-scored containment options (isolate host, disable account, block hash, revoke tokens) with clear blast-radius warnings. The app generates an approval workflow, captures who approved what and why, and auto-builds an incident timeline for post-incident reporting. It’s not a magic “AI solves IR” tool: it’s a decision support layer that reduces human error and speeds up coordination across security, IT, and identity teams. The MVP focuses on a small set of common containment playbooks and tight integrations rather than trying to replace your existing EDR/SOAR stack.