FS-DOC-01Operations
Launch Plan
Cybersecurity Incident Response Automation
[YourCompany.com] �� IT Department · Prepared by FullSpec · [Today's Date]
This Launch Plan sets out exactly what is being built, how the build is phased, what FullSpec needs from you to get started, and what your role looks like once the automation is live. FullSpec handles every aspect of the technical build, from connecting the APIs to testing the end-to-end flow. Your role is to confirm access, review the severity rubric, and stay informed at each stage. Everything you need to know before go-live is in this document.
01What you're launching
Right now, every security alert that fires in Microsoft Defender sets off a manual chain of events: the IT Manager reads the alert, classifies it by judgement, pulls logs from multiple consoles, opens a Jira ticket by hand, notifies stakeholders in Slack, and then writes the incident report from memory after the fact. The process takes up to three hours per significant incident, runs inconsistently depending on who is available, and leaves gaps in the audit trail. This automation replaces the repetitive, error-prone steps with three agents that triage, route, and document every incident automatically, while keeping the IT Manager in control of the one decision that genuinely requires human judgement: confirming or overriding a containment action.
Process
Cybersecurity Incident Response
Trigger
A security alert fires in Microsoft Defender or a connected monitoring tool
Final output
A completed Notion incident report, a closed Jira ticket, and a post-incident Slack summary sent to stakeholders
Agents being built
3 agents: Triage Agent, Notification Agent, Incident Documentation Agent
Tools involved
Microsoft Defender, Microsoft 365, Jira, PagerDuty, Slack, Notion
Volume
Approximately 12 to 20 alerts per week requiring triage
Launch PlanPage 1 of 4
FS-DOC-01Operations
02How the build works
The build is split into four sequential stages. FullSpec leads all technical work across every stage. Your involvement is focused and predictable: a short Connect session to confirm access and agree the severity rubric, a light review during testing, and a final sign-off before go-live. The total delivery estimate is five weeks from the close of Connect. Each stage below shows exactly who does what.
Complexity level: Moderate. This build connects six tools across three agents and requires a custom severity rubric to be agreed before the Triage Agent can be configured. Total estimated build effort is 48 hours across a five-week delivery window. The delivery clock starts at the close of Connect, not payment.
1Connect
Business days 1 to 3
FullSpec
Runs the Connect session, maps the current incident response flow in detail, drafts the severity rubric for IT Manager review, documents escalation rules and containment playbook requirements, and confirms all tool access is in place before the build begins.
You
Attend the Connect session (typically 60 to 90 minutes), provide admin access to Microsoft Defender, Microsoft 365, Jira, PagerDuty, Slack, and Notion, and review and approve the severity rubric so the Triage Agent can be configured correctly.
2Build
Business days 4 to 15
FullSpec
Builds all three agents in sequence: connects Microsoft Defender and Microsoft 365 for the Triage Agent and configures severity classification logic and automatic Jira ticket creation; sets up Slack channel routing and PagerDuty escalation for the Notification Agent; connects Jira and Notion for the Incident Documentation Agent and configures the report template and post-incident Slack summary.
You
Remain available to answer clarifying questions about escalation thresholds or Notion report structure. No technical tasks are required from you during the build stage.
3Test
Business days 16 to 20
FullSpec
Runs end-to-end tests across simulated alert scenarios covering all four severity levels, validates Jira ticket creation, Slack routing, PagerDuty escalation for Critical and High alerts, Notion report generation, and the post-incident summary. Adjusts classification thresholds based on test results and prepares the runbook documentation.
You
Review two to three sample outputs (a classified Jira ticket, a Slack notification, and a Notion incident report) and confirm they match your expectations. Flag any adjustments to report format or channel routing before go-live sign-off.
4Launch
Business day 21 to 25
FullSpec
Switches the automation to live with real Microsoft Defender alerts, monitors the first 48 hours of production traffic, confirms all agents are firing correctly, and delivers the completed runbook and handover documentation to the IT Manager.
You
Confirm go-live readiness, monitor the first few live alerts alongside the FullSpec team, and take ownership of the IT Manager review step in the live workflow. Contact support@gofullspec.com with any questions after handover.
Launch PlanPage 2 of 4
FS-DOC-01Operations
03What FullSpec needs from you
FullSpec needs only access to your existing tools. No technical knowledge is required from you or your team. The table below lists every credential needed and when it must be ready. Having all access confirmed before Connect closes keeps the build on schedule without delays.
Microsoft Defender
Admin-level API access within the Microsoft 365 tenant; correct API scopes enabled for alert retrieval and webhook delivery
Before Connect closes
Microsoft 365
Global Reader or Security Reader permissions to pull audit logs and sign-in activity for affected users and devices
Before Connect closes
Jira
Project admin access to the incident tracking project; permission to create issue types, custom fields, and workflow transitions
Before Connect closes
PagerDuty
Account admin access; ability to create a new service and configure escalation policies for Critical and High severity alerts
Before Connect closes
Slack
Workspace admin access or permission to install apps; confirmation of the incident channel name and any private channel memberships required
Before Connect closes
Notion
Workspace admin or integration permissions to create pages in the incident documentation database; confirmation of the database ID to use
Before Connect closes
The one configuration decision you must confirm before Connect closes is the severity rubric. The Triage Agent cannot be built until the IT Manager has reviewed and approved the criteria that define Critical, High, Medium, and Low alerts, including which asset types, user roles, and alert categories map to each level. FullSpec will draft the rubric for your review during the Connect session, but the final sign-off must come from you. Delaying this decision is the single most common cause of build timeline slippage for this process.
Launch PlanPage 3 of 4
FS-DOC-01Operations
04Your role once live
Role
Ongoing responsibilities
What you no longer touch
You (IT Manager / Business Owner)
Review auto-classified alerts in Jira or Slack when they arrive; confirm or override the automated containment recommendation for each incident; adjust the severity rubric if alert patterns change over time; contact FullSpec at support@gofullspec.com if any agent stops behaving as expected.
Reading raw Defender alerts and deciding severity by judgement; manually pulling logs from multiple Microsoft consoles; opening and filling in Jira tickets by hand; drafting Slack notifications from scratch; writing incident reports in Notion from memory; sending post-incident summaries manually.
FullSpec
Monitors the automation for errors and unexpected behaviour; maintains API connections and updates credential configurations when tool versions change; provides ongoing support via support@gofullspec.com; adjusts agent logic if escalation rules or report requirements change at your request.
N/A
05What success looks like
Timeframe
What to expect
Sign of success
Week 1
The automation is live and processing real Defender alerts. The Triage Agent is classifying incoming alerts and creating Jira tickets automatically. The IT Manager is reviewing classified alerts rather than raw notifications. A small number of rubric adjustments may be needed as real alert patterns are compared against the agreed criteria.
Every incoming alert results in a Jira ticket created automatically within two minutes. Slack notifications are reaching the correct channel. No alerts are being missed or silently dropped.
Month 1
The three agents are running reliably across the full weekly alert volume of 12 to 20 alerts. PagerDuty escalations are firing correctly for Critical and High severity incidents. Notion incident reports are being generated automatically on ticket resolution. The IT Manager's weekly time on incident response has dropped from 7 hours toward the 1-hour target.
Mean time to first notification is consistently under 2 minutes. Incident reports in Notion are complete and structured without manual input. The IT Manager has not needed to write a post-incident summary from scratch.
Month 3
The automation has processed at least 150 alerts. The severity rubric has been refined based on real data. The audit trail in Notion is consistent and complete, meeting any compliance record requirements. Weekly IT overhead on incident response is running at approximately 1 hour versus the previous 7 hours, saving roughly $275/week in IT Manager time. The build has recouped a significant portion of the $6,000 build cost against an estimated payback period of 4 months.
Annual IT staff cost on incident response is tracking toward $2,600 versus the previous $18,200. The team has a reliable, repeatable process for every alert type and no longer depends on individual judgement or memory to handle incidents correctly.
Next step: the FullSpec team will reach out to schedule your Connect session. To prepare, confirm that admin access to Microsoft Defender and Microsoft 365 is available, and identify the IT Manager who will review and sign off the severity rubric during that session. If you have questions before the session, contact FullSpec at support@gofullspec.com.
Launch PlanPage 4 of 4