SOAR with Postee: Automated Incident Response for Cloud Native Risks
summary
Postee automates SOAR workflows by ingesting alerts from Trivy scans and Tracy runtime detectors, evaluating them with policy-based routing with OPA, then taking actions like creating Jira tickets, posting to Slack or killing a suspicious process. Demo shows Trivy run in GitHub Actions sending critical-image findings to Postee which posts to Slack, and a Tracy-generated fileless execution alert matched an OPA rule and produced a Slack notification. The system runs live, reduces pager noise, and can execute remediation steps automatically.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:29Agenda
- 1:41What Is Security
- 5:50Alert Fatigue
- 7:33What Is Alert Automation
- 12:09How Can Postie Help
- 13:43Integrate Posty with Security Tools
related talks
23mSOAR with Postee: Automated Incident Response for Cloud Native Risks
27mAutomated Incident Response for Cloud Native Risks
30mSOARing with Security Onion
14mAutomating Security and Compliance with AI-Based Analyzers
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
17mIncident Response @ Scale-Building a Next Generation SOC
32mClimbing high — getting started with cloud native security through open source
30mIntegrating cloud native security into the SRE culture