Add context to an alert automatically: IP and domain reputation, file verdicts, user and asset details. It is the safest and most useful first automation.
Build and run SOAR playbooks on an open-source platform.
Integrate a SIEM, EDR, ticketing and chat tool.
Automate phishing response end to end.
Add approvals and rollback to risky actions.
Hands-on projects and labs
Deploy Shuffle and TheHive in a lab, and connect them to your SIEM.
Build a phishing playbook that parses an email, checks indicators, opens a case and asks for approval before deleting messages.
Done when you can…
Run a playbook that handles a common alert type from start to finish.
Show that a containment playbook cannot isolate a critical server without approval.
Intermediate
SOAR platforms
SOAR tools give you connectors, a workflow editor, case management and logging. Learn one open-source platform well; the ideas carry over to the commercial ones.
Trigger playbooks from SIEM alerts, pull extra events, and call the EDR to isolate a host or collect a file. Understand what each API action really does first.
Security teams repeat the same steps many times a day: look up an IP address, check a file hash, find who owns a laptop, open a ticket, reset a password. Security automation turns these steps into playbooks that run in seconds, so analysts can spend their time on judgement.
SOAR (security orchestration, automation and response) platforms connect the SIEM, EDR, identity, email and ticketing tools through their APIs. The skills are a mix of scripting, API integration, process design and knowing which actions are safe to automate.
Why it matters
Alert volumes keep growing and teams do not. Automation is how small teams keep up, and engineers who can build reliable, safe automations are in demand in every SOC.
Typical job roles
EntrySOC analyst who scriptsAutomates personal tasks and small enrichments with Python or PowerShell.
Mid-levelSecurity automation engineerBuilds and maintains SOAR playbooks and integrations.
Mid-levelIntegration engineerConnects security tools through APIs and keeps the connections working.
SeniorSenior security automation engineerDesigns the automation architecture, testing and safety rules.
LeadSecurity engineering managerRuns the automation and tooling team and its roadmap.
Prerequisites
Security Operations beginner stage: how alerts are triaged and incidents handled.
Python basics, including working with JSON.
How REST APIs work: requests, authentication and rate limits.
MITRE ATT&CKA knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.
NIST Cybersecurity Framework (CSF) 2.0A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.
STIX and TAXIIThe standard language (STIX) and transport (TAXII) for sharing cyber threat intelligence between tools and organisations.