Empowering the Employee: Incident Response with a Security Bot
summary
A production Slack bot routes user-related alerts from Amazon SQS into an RDS store, DMing employees with event details (timestamps IPs document titles) and forcing a Duo 2FA acknowledgment; unresolved or failed replies escalate to a private security channel. Implementation is multi-agent, supports suppression (one user once triggered hundreds of messages during terraform runs), has explicit alert states, dashboards, and metrics for response rates and escalation counts, and recommends simple messages and upfront classification.
AI-written summary · about
chapters (5)
related talks
24mOne EdTech’s journey to transforming its security practices
01h 02mSecuring data and democratizing the alert landscape
22mSmarter Disasters: End-to-End Automation for Incidents
38mOpening Plenaries: Security in Automation
23mAn EdTech’s journey to transforming its security practices
35mEvent-driven Security with AWS Security Services
29mComposing the Response: Building an Incident Pipeline from Scratch
51mSecurity incident monitoring, mitigation & metrics using feature flags