Security incident triage and response

Give your team the context to act on a security alert. This Mastra template gathers evidence, checks the relevant runbook, and prepares an incident summary and response plan for review. It handles unexpected privilege changes, logins from disallowed countries, and unfamiliar devices. Containment waits for approval.

Why we built this

An alert tells you something happened. Deciding what to do takes more work: checking the account, finding the right procedure, and making sure the response targets the right session or device.

We built this template to bring that context into one review. Your team can inspect the evidence and proposed actions before approving a response. Start with the sample alerts, then connect the services you use.

Features

• Investigate three alert types using identity, endpoint, and cloud evidence.
• Review an incident summary, severity, and response plan with citations to the included runbooks.
• Close events proven benign by policy and flag missing evidence for manual review.
• Require approval of the exact containment plan, then verify the actions taken and record the outcome.
• Try all three scenarios with sample alerts before connecting external services.

Quick start

Requires Node.js ^22.22.0 || >=24.12.0 and npm.

1. Clone the template

npx create-mastra@latest template-security-incident-triage --template https://github.com/drantunes/template-security-incident-triage
cd template-security-incident-triage
npm ci

2. Add your API keys

cp .env.example .env

Set OPENAI_API_KEY in .env. That is the only value you need to supply. Keep the included local settings: the sample workflows need no WorkOS, IPinfo, or Linear account and no approval secrets.

3. Start the dev server

npm run dev

The first start downloads the embedding model and indexes the included runbooks, so allow extra time for it to finish.

Open Mastra Studio, select Workflows → securityIncidentWorkflow, and paste the sample alert for an unfamiliar device into the input. Inspect the incident summary and plan when the run pauses at await-approval. In that step's Resume input, paste resolve.json to approve the local plan or reject.json to finish without containment.

Approval in this demo affects only local sample data. Start a new run to try the same alert again. The Studio walkthrough covers each scenario, including a benign login from the US and a login from Brazil that needs a response. Real containment requires authenticated approval.

Try the complete flow without credentials

After installing the template, you can also run a local demo without an API key or a running dev server:

npm run demo:local -- --output /tmp/security-local-demo

Use a new output directory each time. The demo runs all three alert scenarios, simulates an authorized approval, verifies local containment, and writes demo-report.json to that directory. It uses deterministic model substitutes and synthetic data. See the local demo guide to inspect the results.

Making it yours

• Adapt the runbooks and policy rules to your team's procedures. The guide explains which edits also require a policy change.
• Connect your identity provider, incident tracker, and evidence sources. Start with the included WorkOS, IPinfo, and Linear adapters, or replace them with your own. See provider setup for the required configuration and evidence.

About Mastra templates

Mastra templates are ready-to-use projects that show what you can build with Mastra. Clone one, try it in Studio, and adapt it to your use case.

This community template is authored and maintained by Diego. Want to contribute? Contributions are welcome under the Apache-2.0 license.