SOC automation use cases
Eight SOC automation use cases I have built: alert triage, agentic investigation, phishing response, endpoint isolation, TheHive and Cortex, detection coverage, Wiz remediation, and cloud identity response.
Alert triage and enrichment
Every alert reaches the analyst already enriched, deduplicated and scored, so the first minutes of an investigation are no longer spent copying indicators between tabs.
- Splunk
- IBM QRadar
- Cortex XSOAR
- Cortex XSIAM
- Splunk SOAR
- TheHive
Agentic alert investigation
An LLM agent investigates the alert the way a junior analyst would: it queries the SIEM and the EDR, builds a timeline and proposes a verdict with its evidence. An analyst approves anything that changes state.
- OpenAI
- Claude
- Open-source LLMs
- LangGraph
- Model Context Protocol
- Python
Phishing response
A reported email goes from the user's inbox to a verdict, a mailbox-wide cleanup and an answer to the reporter. An analyst steps in only when the analysis is unsure.
- Microsoft 365
- Google Workspace
- The Phish Analyzer
- VirusTotal
- urlscan
- Recorded Future
Endpoint isolation and account containment
One playbook contains a compromised host or account whichever EDR or identity provider sits underneath: isolate, disable, revoke, verify, and undo when it was a false alarm.
- CrowdStrike Falcon
- Microsoft Defender for Endpoint
- SentinelOne
- Trend Micro
- Cybereason
- Entra ID
TheHive responders and Cortex analyzers
Custom Cortex analyzers and responders turn TheHive into the place where an analyst runs enrichment and response in one click, without switching between consoles.
- TheHive
- Cortex
- Python
- Git
- GitHub Actions
- GitLab CI
Detection coverage and rule health
A measured view of what the SOC can and cannot detect, and a loop that finds rules that never fire, rules that fire too often and log sources that went quiet.
- Splunk
- IBM QRadar
- MITRE ATT&CK
- Atomic Red Team
- Caldera
- Cribl
Cloud findings remediation and patching with Wiz
Wiz findings become owned, prioritized tickets. The safe fixes are applied automatically, and the risky ones go to the team that owns the resource.
- Wiz
- AWS
- Microsoft Azure
- Google Cloud
- Tenable
- Qualys
Cloud and identity threat response
Detections from AWS, Azure and Google Cloud and from the identity provider are investigated and contained with the same playbooks, so a stolen key or a hijacked session is handled the same way in every cloud.
- AWS CloudTrail
- AWS GuardDuty
- Azure Activity Logs
- Defender for Cloud
- Google Cloud audit logs
- Entra ID
Automate your SOC on the stack you already run.
Tell me which tools you use and where your analysts lose time. I reply with where I would start.