Platform

A runbook that runs itself

Every decision in your incident playbook, encoded once, executed automatically from the first alert.

Start free Read the docs

Capabilities

What Parachute does during an incident

Four core actions that run automatically the moment a matching alert fires.

Step 1

Automated host isolation

Quarantine a compromised host via your cloud provider API in under three seconds. AWS, GCP, and Azure supported. No manual firewall rule editing, no SSH session required from your on-call engineer.

  • EC2 security group swap in < 1s
  • GCP VPC firewall rule injection
  • Azure NSG block on match
  • Slack confirmation posted automatically

Step 2

Evidence collection

Parachute pulls CloudTrail logs, process lists, network flow captures, and memory snapshots automatically before an attacker has time to clean up. Evidence is packaged, hashed, and stored for your post-mortem.

  • CloudTrail + VPC flow logs pulled at alert time
  • Running process list captured via SSM
  • SHA-256 hash of every evidence artifact
  • Retention window configurable per tier

Step 3

AI incident timeline

A structured narrative of what happened, when, and what was done. Ready for your post-mortem the moment the incident is contained. Not a raw log dump: a readable timeline your CISO can follow.

  • Chronological event reconstruction
  • Plain-English action summaries
  • Links to evidence artifacts inline
  • Exportable to PDF or Jira ticket

Step 4

Runbook builder

Write runbooks as YAML or use the visual editor. Version-controlled in Git, testable with simulated alerts, and executed exactly as written every time. No click-ops required.

  • YAML and visual editor
  • Git-native version history
  • Simulate alerts before going live
  • Conditional branches and escalation paths

Architecture

The Parachute runbook model

Runbooks are structured YAML documents that define trigger conditions, action sequences, conditional branches, and escalation paths.

Trigger conditions

Match on alert source, severity, tag patterns, or host attributes. Multiple conditions can be combined with AND/OR logic. One runbook can cover dozens of alert variants.

Action steps

Choose from the built-in action library: isolate_host, pull_logs, capture_memory, post_slack, create_ticket, escalate_pagerduty. Or call any REST endpoint.

Conditional branches

Different response paths for different severity levels, cloud providers, or time of day. One runbook file handles the full decision tree without duplicating steps.

Escalation paths

Define when to wake up a human, who gets paged, and what context they receive. Parachute hands off with full evidence already assembled.

Integrations

Fits where your team already works

Connect in minutes. No agent installs on your hosts, no new tooling for your on-call.

PagerDuty

Receive alerts and send escalations via PagerDuty's Events API.

Alerting

Opsgenie

Route Opsgenie alerts to the matching runbook automatically.

Alerting

Datadog

Trigger runbooks from Datadog monitor alerts and composite monitors.

Monitoring

Splunk

Send Splunk notable events and correlation search hits to Parachute.

Monitoring

AWS

EC2 isolation, CloudTrail, VPC flow logs, Security Hub findings.

Cloud

Slack

Post incident notifications, timelines, and evidence summaries to channels.

Communications
View all integrations

Security

Built with security in mind

Your incident data is handled at execution time only. No persistent log storage beyond your configured retention window. TLS 1.3 everywhere.

Read our security practices

Ready to encode your first runbook?

Get running in 15 minutes. No credit card required on the Developer plan.

Start free Read the docs