When an attack happens, AntiLink responds
Write your response once, as a rule. When the Security Incident Center sees a real attack, AntiLink runs your steps in order, even at three in the morning.
Starts free on AntiLink Basic.
Your playbook board
Raid playbook
PlusCooldown 30 minWhen
An incident becomes Critical
Type: Raid
Then
- 1Turn on Emergency Lockdown
- 2Alert a channel
- 3Mark the incident Contained
Trap sprung
PlusCooldown 5 minWhen
A detector fires repeatedly
Honeypot, 2 times within 5 minutes
Then
- 1Time out the user
- 2Alert a channel
Nuke insurance
PremiumCooldown 60 minWhen
A new incident opens
Nuke attempt, High or higher
Then
- 1Quarantine the user
- 2Create a server backup
- 3Alert a channel
Three triggers
A new incident opens
Pick the lowest severity that counts (Medium, High or Critical) and, if you like, one type of threat.
An incident becomes Critical
Fires when an incident opens as Critical or climbs to Critical later in the attack.
A detector fires repeatedly
Choose a detector, how many times (1 to 20) and within how many minutes (1 to 60).
Five steps
Alert a channel
Posts an alert and, if you choose, pings one role. Never everyone.
Mark the incident Contained
Moves the incident on so your team can see it is being handled.
Time out the user
Up to 24 hours. Owners, admins, moderators and bots are never touched.
Turn on Emergency Lockdown
Blocks invites and external links server-wide until you lift it. On Premium, a protected backup is saved first.
Quarantine the user
Strips their roles and keeps them for a one-click Release. Trusted members, staff and bots are never touched.
Create a server backup
Roles, channels and settings, in the automatic lane. Manual backups are never replaced.
Room for more rules as you grow
2 rules
1 step each
10 rules
3 steps each
25 rules
5 steps each
Your plan is checked every time a rule runs. On a downgrade nothing is deleted: your oldest rules stay live and the rest wait for the upgrade.
Built so it cannot run away
Hourly run cap
No server can run more than 30 automations in an hour, however busy the attack.
Per-rule cooldown
After a rule runs it waits out its cooldown, claimed so two bot processes can never both run it.
Pause everything
One switch stops every rule at once. Detection and incidents keep working.
No feedback loops
A rule's own Lockdown never triggers another rule.
A fixed set of safe steps
There is no custom code and no outside web request. Every run is logged with what actually happened, step by step, on the run history and on the incident timeline.
Decide your response before the attack
Add AntiLink, open the Automations tab and write your first playbook in a minute.