SecOps Automation And Orchestration

on YouTube ↗32m

" summary

Open-source SecOps framework called PatrOwl automates scans and aggregates findings into a single DB, using Dockerized engines written in Python/Django (Nmap, dependency-check, SAST/DAST hooks) and connectors to TheHive/Cortex, JIRA and Slack. A demo cluster is compromised by a crypto-miner in 24 hours to justify automation; claim is faster detection and smaller windows of exposure. Engines take 2–3 days to build, system targets CI/CD pipelines and large fleets including environments with 500k containers.

AI-written summary · about

" chapters (7)

1. 0:00Introduction
2. 1:02Defining security operations
3. 3:21IT landscape challenges
4. 8:05Automation benefits
5. 11:57Limits of automation
6. 14:14Framework architecture
7. 22:11Tool demo and conclusion

" related talks

• 21mPatrOwl - The Red Flavour Of SOC Automation And OrchestrationNicolas Mattiocco · HITBSecConf 2019 Amsterdam
• 36mSecurity Automation In A Devops WorldAlan Robertson · DevOpsDays Salt Lake City 2016
• 44mSecurity Research with Open Source Software: Vol. OmegaYesenia Yser · Open Source Summit Europe 2023
• 47mContainerizing your Security Operations CenterJimmy Mesta · AppSecUSA 2016
• 01h 18mDevSecOps - Automating Security in DevOpsAnand Tiwari · DevOpsDays Boston 2019
• 38mDesign Approaches for Security AutomationPeleus Uhley · Black Hat USA 2016
• 30mSOARing with Security OnionWes Lambert · Security Onion Conference 2021
• 50mScaling Security Assessment at the Speed of DevOpsRoger Seagle, Blake Hitchcock, Brian Manifold · AppSecUSA 2016