Scaling Your Defenses: Next Level Security Automation for Enterprise
summary
Roadmap from manual SOC work to full SOAR implementation with concrete steps: ingest AV/EDR, proxy and firewall alerts, collect MITRE ATT&CK hits and sandbox IOCs, apply Virustotal scoring and weighted heuristics, then train simple ML models using metadata (ASN, geolocation, corporate frequency). Example outcomes: 2017 = 50–100 automated events/day with 5 playbooks and ~$75k ROI, 2019 = 25 playbooks processing 25,000 events/day, 2021 = 41 playbooks targeting ~100,000 events/day; use RPA for patch/test/reimage and tune by risk and disruption tolerance.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:30Intro Questions
- 1:38What do "Automations" Look like today?
- 2:16How can I measure my organizations Automation Capabilities?
- 3:58What can Automations look like, and where do we start?
- 4:22Component One: Alert Ingestion
- 5:16Component Two: Data Collection
- 6:55Component Four: Alert Remediation
- 7:53Component Five: Reporting
- 10:57The Missing Component: Automated Alert Analysis (Component Three)
- 11:34Reviewing the Manual Analysis Process for Indicator Scoring
- 12:17Simple Scoring Use Case: Virustotal File/URL Reputation
- 13:01Simple Scoring Summary
- 13:29Implementing Heuristic Analysis
- 15:14Detailed Scoring Use Case: VirusTotal Domain Reputation
- 16:23Heuristic Scoring Summary
- 17:14Uplifting from Heuristic Analysis to Machine Learning Models
- 18:14Training the Machine Learning
- 21:27Tuning the Automations
- 22:27How to Calculate ROI
- 23:51Real-World Automation Return on Investment
- 25:37How do I implement this in my environment?
related talks
44mWhat I learnt about automating security
17mIncident Response @ Scale-Building a Next Generation SOC
50mAutomating security monitoring
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks
03mFighting Every Threat with AI Agents: The Future of Security Operations
33mThe Only Way to Survive Is to Automate Your SOC
53mSecurity Operations 2018: What Is Working? What Is Not.
29mBuilding a Security Operations Program