Automated Incident Response for Cloud Native Risks
summary
Demonstrates an open source SOAR pipeline that ingests JSON webhooks from scanners like Trivy and Tracer (runtime EBPf scanner), evaluates them with policy-based routing using Rego/OPA evaluation, and executes actions such as creating a Jira ticket, sending Slack alerts or terminating a malicious process. The demo wires Trivy to Postie for CVE triage (auto-created Jira ticket) and Tracer to Postie to kill an infected runtime process, showing end-to-end automation that actually generated tickets and enforced responses.
AI-written summary · about
chapters (10)
- 0:00Introduction to talk
- 1:26Current security challenges
- 6:06Alert fatigue explained
- 8:12What is SOAR
- 10:23Introducing Postee
- 15:02Demo with Trivy
- 18:13Demo with Tracy
- 21:48Configuring Postee
- 24:15Postee actions and UI
- 25:38Q&A session
related talks
23mSOAR with Postee: Automated Incident Response for Cloud Native Risks- 23mSOAR with Postee: Automated Incident Response for Cloud Native Risks
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
14mAutomating Security and Compliance with AI-Based Analyzers
30mSOARing with Security Onion
34mIntegrating Cloud Native Security into the SRE culture
30mIntegrating cloud native security into the SRE culture
17mIncident Response @ Scale-Building a Next Generation SOC