Nova Detection & Response eXchange
DRX. Coordinate response across your security tools.
Nova Detection & Response eXchange connects investigation decisions to supported actions in cloud, identity, endpoint, and case-management tools. Build response playbooks, review proposed actions, apply the required approvals, and follow each execution through its reported result. DRX keeps the affected systems, responsible people, and action history together so teams can coordinate containment and follow-up.
Supported actions, required approvals, and visible results.
DRX
Execution gate
Approval checked
Approval statusVerified before execution
01 · Response workflow
Follow the response from proposal to outcome.
Review the proposal, validate the action, obtain any required approval, and track the result. A response from a connected tool does not by itself prove that the intended security outcome was achieved.
- 01
Trigger
Start from qualifying security activity or a reviewed response proposal.
- 02
Validate
Check the selected systems, supported action, and required access.
- 03
Approve
Apply the configured policy and required separation of duties.
- 04
Act
Run the approved, supported action against the selected systems.
- 05
Prove
Retain the execution evidence and reported outcome.
02 · Controls by Design
Response automation with policies and approvals.
DRX blocks an action when its required integration, access, or approval is unavailable. The action remains visibly blocked so the team can resolve the issue before proceeding.
Authorized systems
Response work stays within the customer organization and systems the responsible team is authorized to manage.
Preview before action
Review a playbook in simulation without changing connected systems. A successful simulation does not mean an action has been carried out.
Independent approval when required
When your policy requires it, a different authorized person must approve a high-impact action before it can proceed.
Blocked when requirements are unmet
An action is blocked when the integration, required access, or supported action is unavailable. A blocked or failed action is not reported as successful.
03 · Response Capability Areas
One operating model for design, control and evidence.
Design a playbook, review the actions your integrations support, and follow the proposal through approval, completion, and outcome review.
Command Center
Review current response activity, pending proposals, completed actions, and reported outcomes before deciding which work needs attention.
Automation Studio
Build response playbooks with a clear sequence of supported steps that your team can review before use.
Action Exchange
Explore the supported response actions for each provider, including their purpose and the systems they can affect.
Integration Hub
Check that the integration is connected, the action is supported, and the required access is available.
Response Proposals
Review the proposed action, affected systems, and required approvals before it runs.
Effectiveness and governance
Keep the action history, reported results, and changes available for later review.
04 · Response History
The action is only part of the record. The control path matters too.
Review who requested and approved the action, which systems were affected, and what the connected tool reported. Keep that record with the investigation for later review.
Support is environment-specific.
During evaluation, Hansec confirms which response actions your connected tools support and the permissions and approvals needed to use them.
Evaluate DRX
Bring the response workflow. We will map the controls.
Review a response scenario with Hansec, from the affected systems and supported actions to approvals, execution history, and follow-up.