Incident Response @ Scale-Building a Next Generation SOC
summary
Argues for automating incident response across APIs so alerts drive enriched context gathering from asset management, Active Directory, DNS and ThreatExchange, then trigger automate SIM-to-ITSM workflow to open ServiceNow/JIRA/BMC tickets, collect forensic images and notify via Slack/HipChat bots. Uses CRITs and VirusTotal lookups with thresholds (eg. 70–80% engines) and credential reuse checks against paste leaks to triage known noisy malware versus likely targeted attacks, cutting 20–30 minute per-host triage times and reserving analysts for real investigations.
AI-written summary · about
chapters (6)
- 0:00Start
- 9:16Running the Playbook
- 13:45Communication
- 14:21Incident Management Systems
- 15:08Evidence Collection
- 16:05Benefits of Automation
related talks
29mComposing the Response: Building an Incident Pipeline from Scratch
34mIncidents Happen
31mFuturistic Luxury Incident Response
40mApplying Artificial Intelligence to the Incident Response Function
45mFailure Happens: Improving Incident Response in Large-Scale Organizations
58mKeynote: The Future of Incident Response
54mSOCcing: Responding to a Cyber Incident
55mThe State of Incident Response