Incident Responder
Who does what, and what is due to whom by when.
Run a security incident from first report to closure: classify it, see which reports are due under DORA, NIS2, the Slovak Cybersecurity Act or GDPR and by when, keep the evidence and the timeline, and work through the runbook with RASCI and the communication matrix beside you.
Free while in beta
In beta: open to invited organisations and not billed yet. Write to us and we add yours.
What it does
- Classification wizard and severity, with statutory deadlines per regime (DORA, NIS2, Act 69/2018, GDPR)
- Open regulatory obligations across all incidents, soonest deadline first
- Evidence with versions and chain of custody, stored in Secure Storage
- RASCI per scenario and a communication matrix of who informs whom
- Runbooks and checklists run step by step, every action on the timeline
How this tool bills
Today's list prices in EUR, read from the qzila price list when this page was built. You are billed monthly for what you used.
In beta: open to invited organisations and not billed yet. Write to us and we add yours.
The API
Every qzila tool is a GraphQL API first; the web UI is one client of it. Anything you can do in the browser you can do from a script, a CI job or the Asign platform.
https://incident-responder.tools.qzila.com/graphqlPOST · application/json · { "query": "…" }
Requests are authenticated with your qzila session (the same sign-in as the browser). For automation, sign in once at identity.qzila.com and reuse the session cookie; API keys for service accounts are on the roadmap.
Whatever this tool detects — a verdict flip, a regression, a change, an incident — is emitted as a signal to the qzila alert hub, which forwards it to email, Slack, a webhook or Jira, and to Service Watch, which can also send it as an SMS. Each signal carries the asset it belongs to, so you can correlate it back to your own inventory (or to an Asign asset).
Main operations
reportIncidentmutationReport an incident: title, source, when it was detected, who owns it.
mutation { reportIncident(input: { clientRequestId: "3f6c1a9e", title: "Mailbox takeover", source: "socAlert", detectedAt: "2026-10-20T08:12:00Z", assignToMe: true }) { id ref lifecycleState } }obligationsOpenqueryEvery open statutory report across your incidents, soonest deadline first.
query { obligationsOpen { incidentRef regime stepKey deadlineAt status } }incidentsqueryThe incident list with filters: state, type, severity, owner, dates.
query { incidents(filter: { states: ["new"], sla: "breached" }) { rows { ref title type status } truncated } }
Send requests to https://incident-responder.tools.qzila.com/graphql
Questions about Incident Responder
Where do alerts go?
Every tool reports through one alert hub. You choose per destination: email, Slack, a webhook, SMS or a Jira ticket — and Service Watch shows the same signals on one board.
Where is my data kept?
The tools run on AWS in the EU (Frankfurt), operated by adcore s.r.o., a Slovak company. A few services they rely on sit outside the EU — Stripe for card payments, Google for analytics after your consent, the threat-intelligence lookups behind Safe Check — and the privacy policy lists each one.
Start with one tool. Add more when you need them.
In beta: open to invited organisations and not billed yet. Write to us and we add yours.