SOARing with Security Onion
summary
Shows how Security Onion pushes events to automation platforms and actually remediates: Strelka flags an obfuscated poker.bat with Strelka yara match, a webhook posts the observable to n8n, n8n launches a Velociraptor hunt, the hunt returns one matching client and the workflow issues a quarantine, and Security Onion logs the remediation. Covers integration options (TheHive webhooks, ElastAlert, Logstash), community SOARs (Shuffle, n8n) and cautions about playbooks, manual validation, and production use.
AI-written summary · about
chapters (7)
- 0:00Introduction to SOAR
- 1:23SOAR platforms and options
- 3:35Planning automation playbooks
- 7:52Integration and data sources
- 12:26Advanced automation techniques
- 15:35Use cases for SOAR
- 18:40Live demo and conclusion
related talks
23mSOAR with Postee: Automated Incident Response for Cloud Native Risks- 23mSOAR with Postee: Automated Incident Response for Cloud Native Risks
31mThe Curious Case Of The Rogue SOAR
27mAutomated Incident Response for Cloud Native Risks
28mScaling Your Defenses: Next Level Security Automation for Enterprise
32mSecOps Automation And Orchestration
02mSecurity Operations & Threat Intelligence
16mA Thrilling Journey into Data-Driven Security Automation