SOAR with Postee: Automated Incident Response for Cloud Native Risks
summary
Postee is a SOAR message router that ingests tool outputs like Trivy scan results and runtime alerts from Tracy, evaluates them with OPA policy routing, and executes remediation actions such as Slack notifications, ticket creation, or even terminate malicious process on hosts. Demos use GitHub Actions to send Trivy critical vulnerabilities into Postee which posts to Slack and a simulated Tracy fileless execution event that is triaged and routed correctly. Claimed result is fewer noisy alerts and automated playbook execution.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:29Agenda
- 1:41What Is Security
- 5:50Alert Fatigue
- 7:33What Is Alert Automation
- 12:09How Can Postie Help
- 13:43Integrate Posty with Security Tools
related talks
23mSOAR with Postee: Automated Incident Response for Cloud Native Risks
27mAutomated Incident Response for Cloud Native Risks
30mSOARing with Security Onion
14mAutomating Security and Compliance with AI-Based Analyzers
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
17mIncident Response @ Scale-Building a Next Generation SOC
30mIntegrating cloud native security into the SRE culture
29mProactive Ops: Event Driven IT Operations