Skip to main content

Support Playbooks

Who this is for​

This page is for operators and support-facing users who need the shortest safe path from a Dralvia result to the next decision.

Role-based start here​

  • SOC or analyst: start with phishing and escalation.
  • Crypto reviewer: start with smart contract posture and pre-sign.
  • AppSec or engineering: start with repo scan and downstream exports.
  • Identity or SaaS reviewer: start with OAuth and identity review.

Before you start​

  • Confirm which surface you are operating on.
  • Keep the original input available for retest if needed.
  • Decide whether you need only a verdict or a shareable artifact too.

Use these playbooks when you need the shortest safe path from a risky input to a human decision.

Step-by-step​

Phishing​

  1. Run the suspicious link or domain through the URL & phishing scanner.
  2. Read the explanation before the raw flags.
  3. Export the report or EvidencePack (Dralvia's exportable evidence report) if another person needs to review it.
  4. Escalate only if the decision changes a real business action.

smart contract​

  1. Start with Contract Scanner to understand the contract itself before anyone interacts with it.
  2. Then use Pre-Sign Preview & Wallet Risk Review for the exact action the wallet is about to sign.
  3. Read the summary first, then the recommended action, then the confidence and transparency context.
  4. Treat unlimited approvals, operator grants, router-based batch actions, and low-transparency delegated-spend paths as approval decisions, not background technical detail.
  5. Save the exported result or EvidencePack before another person signs, approves, funds, or escalates the case.

Repo​

  1. Upload the zip or run the CI gate against the repo package.
  2. Read effective risk before suppressing anything.
  3. Export SARIF or SBOM only after confirming the finding quality is usable downstream.
  4. Suppress known-good noise with a reason so it does not silently come back later.

Identity and OAuth​

  1. Review the grant, session anomaly, or risky app explanation.
  2. Confirm workspace scope before taking action.
  3. Use response actions only after the explanation and evidence are clear enough for audit.
  4. Record the reason for revoke, block, or follow-up.

Escalation rule​

If the result changes whether someone should open, connect, sign, execute, or isolate, treat it as an action decision and save the evidence.

Day-2 operations​

  • Reuse the same playbook on fresh inputs instead of improvising every time.
  • Review noise and suppression decisions regularly.
  • Keep the evidence path consistent when another team may need to audit the action later.

Self-check playbook​

  • Did the operator choose the right Dralvia surface?
  • Did they preserve evidence before taking an action?
  • Did they record why a suppress, revoke, block, or follow-up decision was made?
  • Can another operator repeat the same flow tomorrow?

What each button does​

  • Scan, Analyze, or Preview starts the active review.
  • Export creates a portable artifact for another team or system.
  • Suppress marks confirmed noise and should always carry a reason.
  • Send to Security or escalation controls move the result into the next workflow.

Troubleshooting​

  • If the wrong surface was used, restart with the correct one rather than forcing interpretation.
  • If the smart contract result looks shallow, confirm whether you are looking at contract posture, wallet action risk, or both.
  • If the export is not enough, generate a report or EvidencePack instead.

API and automation​

  • Use API routes for repeatable ingestion after the manual playbook is clear.
  • Prefer one tested webhook, repo gate, or automation path before expanding further.
  • Keep human review for actions that change access, spend, execution, or isolation.

API error quick reference​

  • 401 Unauthorized: the session or API credential used for the current playbook is missing or invalid.
  • 403 Forbidden: the operator can view the surface but does not have permission for the requested action or export.
  • 404 Not Found: the referenced scan, review result, artifact, or escalation object could not be found.
  • 429 Too Many Requests: the workspace hit a workflow rate limit or temporary cooldown; retry later.
  • 500 Internal Server Error: the backend failed while building evidence, exports, or escalation context; retry once before escalating support.

Next best actions​

Related guides:

FAQ​

When should we escalate?​

When the result changes whether a user or team should trust, open, connect, sign, execute, or isolate something.

When should we suppress?​

Only when the finding is confirmed noise and a reason is recorded.

What is the safest habit across all modules?​

Preserve evidence before taking an irreversible action.

Next steps​

  • Pick the playbook that matches the current input.
  • Run the workflow end to end once.
  • Save the resulting evidence.

Known limits and rate limits​

  • Plan quotas apply: scan, render, report, repository, and API-key limits follow your plan tier. See Pricing & Plans for the enforced defaults.
  • API requests are rate limited per workspace. A 429 Too Many Requests response means a rate or quota window was exceeded; wait for the reset window, then retry once and reduce burst volume.
  • Free Evaluation has the tightest limits and is subject to anti-abuse controls. Paid plans raise the limits; Enterprise sets custom limits by contract.