Build a phishing-triage remediation workflow for a SOC. Its job is to take a security case (e.g. a reported phishing email with indicators like domains and file hashes) and give analysts one-click remediation buttons directly on the case, then log every action back to the case for a clean audit trail. Trigger it via HTTP routes. Each remediation button on the case points at its own authenticated route step that performs one action when clicked. Assume cases are stored/enriched upstream and persisted so each remediation step can look up the case record (indicator values plus the case ID) by a reference passed in the URL. At a high level, build these pieces: A remediation step that blocks a malicious domain by adding it to a DNS filtering denylist — use NextDNS, or your team's DNS/network filtering tool. A remediation step that blocks a malicious file hash by adding it as a "prevent" IOC in your EDR — use CrowdStrike, or your team's endpoint protection platform. After each action succeeds, write a note back onto the case record summarizing what was done (via your case management platform's API — this workflow uses the Tines Cases API), and remove the corresponding action button so it can't be clicked twice. Return a simple branded HTML confirmation page to the analyst who clicked, showing success or the failure status. Keep the actions modular so more remediation buttons can be added the same way (e.g. suspend a user in your IdP, contain a host in your EDR, open a follow-up ticket, or alert a SOC channel — swap in whatever tools your team uses). Tools used: NextDNS, CrowdStrike, Tines Cases API