What is the coolest SOAR automations you’ve seen?

I’m curious what some of the coolest soar workflows you’ve seen to get ideas of what to do next?

I recently completed a workflow that automates our phishing submission response.

When I joined the team, they had a mailbox for the phishing submissions along with the SIEM alert that were not easy to correlate.

An email would come into the mailbox -> analyst investigates and makes determination -> analyst then responded to the user letting them know the determination -> forwards the email to CISA if it’s phishing -> manually moves the email to the correct folder -> places blocks for IOCs -> updates SIEM alert -> make report if anyone interacted with IOCs -> creates ticket

Now: analyst looks at SIEM incident -> uses the resources linked in the alert (link to email, link to queries, link to paint tools) -> come to determination and select 1 of 3 options in the ticket comments.

From there all of the previously manual tasks are automated! And investigative queries are ran with the results listed in the alert.

I’m so happy to have saved my team so much time they can use to learn and grow.

Anything else people have seen that I can try next? submitted by /u/AverageAdmin
[link] [comments]


http://dlvr.it/SxlmMl