Detects leaked passwords and API keys immediately, freezes compromised AWS keys in under 2 seconds, logs out active Okta sessions across all devices, checks CloudTrail logs for unauthorized access, and saves a tamper-proof SOC 2 audit record.
// Checked in under 5ms upon leaked credential alert
rule secops_revocation_gate {
match:
threat.score > 85 ||
threat.type == "credential_leak"
allow:
system.execute([
"okta.revoke_all_sessions",
"aws.deactivate_access_key"
]) &&
log.destination == "tamper_proof_soc2_ledger"
action:
execute_emergency_containment(
sla_seconds: 5,
channel: "#security-soc-alerts",
notify_actors: ["ciso", "soc_lead"]
)
}