Warden

Warden turns alerts into cases and runs response runbooks against them. Every runbook version is immutable, steps that change something can wait for a second person to approve them, and each run keeps a hash-chained record of what it did.

With Warden you can:

• open cases from alerts sent by detection tools, or by hand
• write runbooks in YAML with Jinja templating, and run them on a case
• require four-eyes approval on the steps you choose, so nobody approves their own request
• connect chat, ticketing, email, paging and enforcement tools as actions
• track evidence, tasks and service-level timers on each case

Start here

1. Install Warden on one host.
2. Connect the tools runbooks will act on under Integrations.
3. Read the runbook authoring guide and the action reference, both under Guides in the sidebar, and write your first runbook.

To script Warden, read the API page.

Before you turn on Warden’s AI features, read AI features for what they send to your model and how to switch them off.