Follow-up Actions

When triage finishes, it doesn't just suggest what to look into, CloudPeek can carry out those steps automatically. Each step is a follow-up action, and the Follow-up worker runs them in the background using read-only access to your tools.

What a follow-up action is

A follow-up action is one item in the investigation plan triage generated, for example:

"Check whether this source IP appears in firewall logs in the last 24 hours."
"Look up this file hash on VirusTotal."
"List recent sign-ins for this user."

Each action has a description, a category, a priority, and a flag for whether it can be automated.

How they run

Every minute or so, the Follow-up worker:

Recovers any actions that have been stuck too long and retries them.
Picks up a batch of pending actions (locking them so they aren't double-run).
Runs each one through an AI agent loop: the agent queries your connected tools to gather the evidence the step calls for, iterating until it has an answer.
Stores the agent's findings on the incident, attributed to the tool used.
Regenerates the incident summary so analysts always see the latest findings: and when all follow-ups for an incident are done, produces a final updated summary.
Records any new entities it discovered for the Wiki.

The guardrails (important)

Autonomous follow-up actions are deliberately constrained so the automation can never change your systems:

Read-only tools only. The agent is configured for read/query access; write tools are removed from what it can call, and any write attempt that somehow slips through is blocked.
Explicit prohibitions. The agent is instructed never to apply patches, restart services, change configuration, deploy code, open or close tickets, write to databases, or call any state-changing API. Its role is strictly data collector.
No final determinations. It gathers and reports facts; it doesn't make conclusive risk decisions, that's for the analyst.
Structured, sourced output. Every run reports under a consistent template (Overview / Findings / Data Gaps) with citations to where each fact came from, so the analyst can trust and verify it.

Important

This is the key safety boundary in CloudPeek's automation: everything the platform does on its own is observe-and-report. Any action that alters your environment happens only in an interactive investigation where a human approved it under Human-in-the-Loop.

Reliability

Retries with backoff. Transient failures (rate limits, timeouts, temporary overload) are retried later with increasing delay.
Fail-fast on real errors. Genuinely unrecoverable problems (bad credentials, a tool that isn't configured, a not-found resource) stop quickly but keep partial results for inspection.
Stuck-work recovery. Actions that run too long are reset and retried, up to a limit.

What you see as an analyst

Open a triaged incident and look at the Next Steps tab: it shows the plan and, as follow-ups complete, the findings each one produced. Because the summary is regenerated after each step, the incident's overview stays current without you refreshing anything.

Could follow-ups ever take action?

Not autonomously. Letting an agent take write actions on your systems would require routing it through the Human-in-the-Loop approval surface, which exists for interactive investigations. Until and unless a human is in that loop, background follow-ups remain observe-only by design.

Automatic Triage: produces the plan.
Human-in-the-Loop: how write actions are gated.
Background Workers: the worker that runs follow-ups.