How it works

From alert to contained, automatically

A step-by-step look at what Parachute does the moment your monitoring stack fires an alert.

Start free Quickstart guide

The execution sequence

Five steps from alert to resolution

Every step runs automatically. Your on-call engineer reviews, not recovers.

Step 01

Alert intake

Parachute receives the alert from PagerDuty, Datadog, Opsgenie, or a direct webhook. The payload is parsed to extract the host ID, alert type, severity, and source tags. No new tooling needs to be installed on your on-call engineer's machine.

Incoming alert payload 
{
  "source": "datadog",
  "alert_id": "8831992",
  "host_id": "i-0a1b2c3d4e5f",
  "severity": "critical",
  "tags": ["brute-force", "ec2", "prod"],
  "timestamp": "2024-08-14T03:14:22Z"
}

Step 02

Runbook match

Parachute evaluates the alert against all runbooks in your workspace. The first matching runbook by priority order is selected. If multiple runbooks match, all are queued. No match means the alert is forwarded to your fallback channel unprocessed.

Step 03

Action execution

Each action in the runbook runs in sequence. Host isolation happens first (within seconds), then log collection, then any additional steps. Actions that can run in parallel are scheduled concurrently. Every action result is logged for the evidence package.

Step 04

Evidence package

All collected artifacts are hashed with SHA-256 and assembled into a structured evidence package. The package is stored for the configured retention window. Exportable to PDF, Jira, or Linear at any time.

Step 05

Notification

Parachute posts to your configured Slack channel with the incident summary, actions taken, and a link to the full evidence package. The AI-drafted timeline is included in the post. Your on-call engineer wakes up to a resolved incident with full context, not an open question.

Writing runbooks

Writing runbooks for Parachute

Runbooks are YAML files. They define what triggers execution and what actions to take. Here is a complete example for AWS EC2 brute force response.

ec2-brute-force-response.yaml 
name: EC2 Brute Force Response
version: "1.0"
description: Isolate, collect, and document on brute force detection
trigger:
  sources: [datadog, pagerduty, opsgenie]
  conditions:
    - alert.tags includes "brute-force"
    - alert.severity in [high, critical]
steps:
  - id: isolate
    action: isolate_host
    target: "{{ alert.host_id }}"
    provider: aws
    method: security_group_swap
    isolation_sg: "{{ workspace.isolation_sg }}"
  - id: collect
    action: pull_logs
    sources:
      - cloudtrail
      - vpc_flow_logs
    window: 60m
    parallel: true
  - id: processes
    action: capture_process_list
    target: "{{ alert.host_id }}"
    via: ssm
  - id: timeline
    action: draft_timeline
    ai: true
    include: [isolate, collect, processes]
  - id: notify
    action: post_slack
    channel: "{{ workspace.incident_channel }}"
    template: incident_summary
    on_call: true
on_no_match:
  forward_to: "{{ workspace.fallback_channel }}"

In the field

Common scenarios

Four incident types and the automated response Parachute runs for each.

Ransomware on EC2 instance

Alert from Datadog or GuardDuty signals encryption activity. Parachute isolates the host, pulls CloudTrail for the 60 minutes prior, captures the running process list, and creates a forensic snapshot. Slack notification with containment summary sent within 20 seconds of alert.

Credential stuffing on login endpoint

High-volume failed authentication detected. Parachute triggers a rate-limit rule via the application load balancer API, captures the source IP list from VPC flow logs, creates a Jira ticket with the evidence package, and pages the on-call if the attempt rate exceeds threshold.

Suspicious lateral movement in VPC

Unusual east-west traffic detected between subnets. Parachute pulls VPC flow logs for the involved hosts, queries CloudTrail for any IAM changes in the prior 2 hours, isolates the originating host if confidence is high, and posts a movement map to the incident channel for human review.

IAM privilege escalation

CloudTrail detects an unexpected AttachRolePolicy or CreateAccessKey call. Parachute captures the full IAM event chain, checks the principal's recent activity, revokes the suspicious credentials via the AWS API, and posts a condensed timeline to your incident Slack channel immediately.

Ready to encode your first runbook?

Connect your alerting tool, write one runbook, test with a simulated alert. You can be live in 15 minutes.

Start free Quickstart guide