Security Automation Simplified
summary
Shows a concrete pipeline: a Splunk alert posts JSON to a lightweight Flask API on a DigitalOcean droplet which calls the Atlassian Python SDK to create a JIRA ticket, then webhooks trigger enrichment routines that query Active Directory via ldap3 and VirusTotal. Code is small, modular scripts not a monolith, runs end to end and produces populated tickets; team reports 81 hours saved per week. Emphasizes starting small, making jobs asynchronous, and using Splunk → webhook → Flask API and JIRA issue enrichment patterns.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:05Security Monitoring
- 2:54Splunk
- 3:27Create Alert
- 4:33Flask
- 6:00Automation Server
- 6:59Secret Management
- 7:45JIRA
- 8:43Webhooks
- 9:11Create a Webhook
- 9:46Automation Server Pie
- 11:36Automation Server Code
- 12:18VirusTotal Script
- 13:23Recap
- 14:01Automation
- 14:52Automation Considerations
- 17:24Automation Metrics
- 18:30Summary
- 20:21Questions
related talks
46mBuilding An AppSec Pipeline: Keeping Your Program, And Your Life, Sane
50mAutomating security monitoring
40mAutomation of Security Scanning: Easy or Cheese
51mTaking AppSec to 11: Pipelines, DevOps and making things better
27mStandard Classification: Automate Security, Don't Tell Your Boss
38mDesign Approaches for Security Automation
43mBuilding a Secure DevOps Pipeline
24mReliability Runs Efficiently at the Junction of Automation and Agile