On this page
Torq: automation features and setup
An automation and AI agent platform for security operations. It helps sort alerts, investigate incidents, and coordinate responses.
Tool by the Otomatzia editorial team · source content checked on
Overview
Torq focuses on SOC work: collecting alerts, removing duplicates, enriching context, and opening an investigation workflow. It also includes incident management and integration with security and IT tools. It is a product for a security team with defined response procedures, not a substitute for judgment about unusual activity. A useful evaluation checks which alerts are correctly closed, what is escalated to an analyst, and how decisions can be reviewed afterward.
Features
- Sort alerts, identify duplicates, and prioritize them by context.
- Investigation and response agents alongside incident management capabilities.
- Activity logging and the ability to intervene manually in a workflow.
Business uses
- Enrich a phishing report and open a case for an analyst to handle.
- Consolidate alerts from multiple cloud systems and route important cases for review.
Getting started
- Choose an alert family with labeled examples and established procedures.
- Run the sorting workflow in recommendation mode and compare it with team decisions.
- Add automated responses only for actions that have been defined and approved in advance.
What to check
- Also measure genuine alerts that were mistakenly classified as noise, not just the amount of work saved.
- Set separate permissions for information collection and response actions such as changing access or blocking.
Sources to check next
Vendor features and prices change. Confirm details on the linked official pages before you rely on them.