AWS Security Incident Response
Read list memberships, list cases, list comments from Security IR (SigV4).
OCNORA ships 4 typed AWS Security Incident Response operations. Each node has a schema-driven form, input and output tables beside its settings, and is pre-flighted by Workflow Health before your first real run.
Before you connect AWS Security Incident Response
- Authentication
- API key
- Credential
- {"access_key_id", "secret_access_key"}
- Connection test
- Available: the stored credential can be checked against the provider when you add it. This is not a record that a test was run or passed.
What you can do with AWS Security Incident Response
Operations, grouped by what they do to your data.
Read and search 3
Other operations 1
A sample AWS Security Incident Response workflow
- 1A core triggerStart the run from a chat, form, manual, schedule, webhook, workflow trigger — no AWS Security Incident Response trigger is needed.
- 2List Casessecurity_ir.list_casesLists all cases the requester has access to.
- 3Write Actionsecurity_ir.callRun one of 13 write actions on Security IR.
An outline built from this provider’s node contracts, not a recorded run. Each step’s output fields are available to the next in the field picker.
Every node below has a reference page: what it does, the connection it needs, its config fields with types, constraints and examples, and the shapes it emits.
Operations 4
- Write ActionRun one of 13 write actions on Security IR.security_ir.call
- List CasesLists all cases the requester has access to.security_ir.list_cases
- List CommentsReturns comments for a designated case.security_ir.list_comments
- List MembershipsReturns the memberships that the calling principal can access.security_ir.list_memberships
AWS Security Incident Response questions
- How does OCNORA authenticate with AWS Security Incident Response?
- With a stored API key credential, shaped {"access_key_id", "secret_access_key"}. A connection test can check it when you add it.
- What can I automate with AWS Security Incident Response?
- 4 typed operations, each with a reference page listing its config fields and the shapes it emits.
- What if the AWS Security Incident Response operation I need is not listed?
- Where AWS Security Incident Response has an HTTP API, call it from the HTTP node with the same credential, or describe the step to the AI builder, which asks our team for a typed node when one is missing.
- Are there templates that use AWS Security Incident Response?
- Not yet. Start from a blank workflow, or describe the workflow to Build with AI.
- How are AWS Security Incident Response calls controlled?
- Every call and every run step is audited, runs count against the execution budget, and Workflow Health pre-flights the workflow when you save it.
See your first AWS Security Incident Response workflow run.
Book a technical demo. We add the connection, pick a template or describe the workflow to Build with AI, and Workflow Health checks it before it runs.