<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: security-operations-automation
description: >-
  Security operations automation with SOAR playbook development, threat intelligence
  workflows, ChatOps integration, vulnerability remediation, event enrichment,
  compliance reporting, dashboard automation, incident classification, automated
  threat hunting, access review, security notifications, and posture scoring.
  Use when asked for SOC automation, SIEM integration, SOAR playbooks, security
  orchestration, or operational security workflow development.
domain: cybersecurity
subdomain: security-operations-automation
tags:
  - soar
  - siem
  - threat-intelligence
  - chatops
  - vulnerability-management
  - event-enrichment
  - compliance
  - dashboards
  - incident-classification
  - threat-hunting
  - access-review
  - notifications
  - posture-scoring
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  Python 3.10+, Splunk SDK, Elasticsearch 8+, Cortex XSOAR, Shuffle SOAR,
  Slack SDK, PagerDuty API, VirusTotal API, MISP, OpenCTI, Jira API.
metadata:
  mitre-attack: ["T1059", "T1078", "T1110", "T1190", "T1053"]
  nist-csf: ["DE.AE-1", "DE.AE-2", "DE.CM-1", "RS.AN-1", "RS.RP-1"]
  cis-controls: ["8.1", "8.2", "8.5", "8.11", "13.1", "17.1"]
---

# Security Operations Automation

## When to Use

- SOAR playbook development for automated incident handling and orchestration
- Threat intelligence ingestion, enrichment, and distribution workflows
- Security ChatOps integration with Slack, Teams, or PagerDuty
- Vulnerability remediation workflow automation and tracking
- Security event enrichment with threat intel, GeoIP, and asset context
- Compliance reporting automation for SOC 2, PCI DSS, HIPAA, NIST
- Security dashboard automation with metrics, KPIs, and alerting
- Incident classification and severity scoring with ML-assisted triage
- Automated threat hunting with hypothesis-driven queries
- Access review and certification process automation
- Security notification systems with escalation and routing logic
- Security posture scoring and continuous assessment

## Prerequisites

- Python 3.10+ with type hints
- SIEM access (Splunk, Elastic, Sentinel) with API credentials
- SOAR platform (Cortex XSOAR, Shuffle, Tines) or custom orchestrator
- Threat intelligence feeds (VirusTotal, MISP, OTX, AbuseIPDB)
- Communication APIs (Slack, PagerDuty, Teams webhooks)

## Quick Reference

| Task | Tool/Command |
|------|-------------|
| SOAR playbook trigger | `node scripts/agent.js --action run-playbook --playbook isolate-host` |
| TI enrichment | `node scripts/agent.js --action enrich-ioc --ioc 1.2.3.4` |
| ChatOps alert | `node scripts/agent.js --action notify --channel #soc --severity critical` |
| Vuln remediation | `node scripts/agent.js --action remediate --cve CVE-2024-1234` |
| Event enrichment | `node scripts/agent.js --action enrich-event --event-id EVT-001` |
| Compliance report | `node scripts/agent.js --action compliance-report --framework soc2` |
| Dashboard refresh | `node scripts/agent.js --action refresh-dashboard --dashboard soc-overview` |
| Classify incident | `node scripts/agent.js --action classify --incident INC-001` |
| Threat hunt | `node scripts/agent.js --action hunt --hypothesis lateral-movement` |
| Access review | `node scripts/agent.js --action access-review --scope admin-users` |
| Notify escalation | `node scripts/agent.js --action escalate --incident INC-001 --tier 2` |
| Posture score | `node scripts/agent.js --action posture-score --scope full` |

## Workflow

### 1. SOAR Playbook Development

1. Define trigger conditions (alert type, severity, source)
2. Build decision tree with enrichment, containment, notification steps
3. Implement playbook actions as idempotent Python functions
4. Test with synthetic alerts in staging SOAR environment
5. Deploy with approval gate and audit logging

Read `techniques/implementing-soar-playbook-development/SKILL.md` for playbook patterns and action templates.

### 2. Threat Intelligence Automation

1. Configure feed ingestion (TAXII, STIX, REST APIs)
2. Normalize indicators to common schema (STIX 2.1)
3. Enrich with multi-source correlation (VT, MISP, AbuseIPDB)
4. Score and prioritize based on relevance and confidence
5. Distribute to SIEM, firewall, EDR via automated push

Read `techniques/automating-threat-intelligence-workflows/SKILL.md` for feed integration and enrichment pipelines.

### 3. Security ChatOps Integration

1. Register Slack/Teams bot with scoped permissions
2. Map alert severities to notification channels and escalation paths
3. Implement interactive response actions (acknowledge, investigate, escalate)
4. Add context enrichment to alert messages (asset info, TI hits)
5. Audit log all ChatOps actions for compliance

Read `techniques/building-security-chatops-integration/SKILL.md` for bot architecture and command handlers.

### 4. Operational Metrics and Posture Scoring

1. Define security KPIs (MTTD, MTTR, alert volume, false positive rate)
2. Aggregate metrics from SIEM, vulnerability scanner, IAM, EDR
3. Calculate composite posture score with weighted controls
4. Generate dashboards with trend analysis and SLA tracking
5. Alert on posture degradation or metric threshold breaches

Read `techniques/automating-security-posture-scoring/SKILL.md` for scoring models and dashboard automation.

## Verification

- [ ] SOAR playbooks execute end-to-end with synthetic alerts
- [ ] Threat intel feeds ingest and normalize within SLA
- [ ] ChatOps notifications deliver with correct routing and escalation
- [ ] Vulnerability remediation workflows track through closure
- [ ] Compliance reports generate with accurate control evidence
- [ ] Posture scores reflect current security state accurately

## Quick Reference

```bash
# List all automation techniques
ls skills/security-operations-automation/techniques/

# Run a specific automation agent
python3 skills/security-operations-automation/techniques/<technique>/scripts/agent.js --help
```

## References

- NIST SP 800-61r2 (Incident Handling Guide)
- SOAR Platform Best Practices
- MITRE ATT&CK Framework
