Respond — now
For when it is already happening. Reach a person, capture what is about to disappear, or shut the door on the thing being abused — each one bounded, and each one reopened only by you.
Open an incident
Sign in and open an incident against a host, a contract or a target you have already enrolled. This is the way in, not a page about the way in.
Reach an analyst
For when something is already happening: an incident tracked to a stated conclusion, volatile state captured before it disappears, and a person to talk to.
Site lockdown
A lock-only circuit breaker for your own web server: an agent you install writes a flag file your reverse proxy reads, and every visitor but one allow-listed operator address gets a static 503 instead of your site.
Host containment
On a host you enrolled for ransomware detection, the agent can kill the process it attributed to its own critical alert and isolate that host's network — once you have armed it, in two separate places.