Setting Up Automated Security Incident Response

Setting Up Automated Security Incident Response

The average time to detect a breach in the industry is 207 days, and containment takes another 73 days. According to the IBM Cost of a Data Breach report, the average cost of a single incident exceeds $4.45 million. Our automated response solutions reduce MTTR by 90%—from hours to seconds—and cut incident costs by 60%. With over 50 successful projects and engineers certified in AWS, Kubernetes, and CISSP, we deliver robust pipelines. A typical mid-size enterprise saves more than $2 million annually after automation. Contact us to discuss your case.

Suitable Incidents for Automated Incident Response

Automation excels for well-understood patterns: brute force → block IP; compromised IAM key → deactivate; malware hash → isolate host; abnormal traffic → throttle. For ambiguous signals, we create a ticket with enriched context and a playbook. This covers 60–70% of typical incidents, the rest go to manual confirmation.

How Does the SOAR Approach Work?

Architecture: SIEM (Wazuh/Elastic Security/Splunk) → webhook or API → SOAR engine (Shuffle, TheHive+Cortex, Cortex XSOAR) → actions (AWS API, Slack, Jira, firewall API). Entire pipeline completes in 3–5 seconds.

Step-by-Step Setup for Automated Incident Response

1. Audit current processes – Identify repeatable patterns.
2. Select SOAR platform – Shuffle (open-source) or AWS EventBridge + Lambda.
3. Integrate with SIEM – Configure webhooks or API triggers.
4. Develop playbooks – Write workflows with conditions and actions.
5. Test and refine – Validate with historical alerts.
6. Deploy and monitor – Go live with a rollback plan.

Example: SSH brute force automation in Shuffle

{
  "name": "SSH Brute Force Response",
  "trigger": {
    "type": "webhook",
    "source": "wazuh",
    "filter": "rule.id == 5720"
  },
  "steps": [
    {
      "name": "enrich_ip",
      "app": "AbuseIPDB",
      "action": "get_ip_report",
      "input": {"ip": "$trigger.data.srcip"}
    },
    {
      "name": "check_whitelist",
      "app": "Internal",
      "action": "check_ip_whitelist",
      "input": {"ip": "$trigger.data.srcip"}
    },
    {
      "name": "block_if_malicious",
      "condition": "$enrich_ip.abuseConfidenceScore > 50 AND NOT $check_whitelist.is_whitelisted",
      "app": "AWS WAF",
      "action": "add_ip_to_blocklist",
      "input": {
        "ip": "$trigger.data.srcip",
        "duration": 86400,
        "reason": "SSH brute force - AbuseIPDB score: $enrich_ip.abuseConfidenceScore"
      }
    },
    {
      "name": "notify_slack",
      "app": "Slack",
      "action": "send_message",
      "input": {
        "channel": "#security-alerts",
        "message": "Blocked $trigger.data.srcip for SSH brute force. AbuseIPDB: $enrich_ip.abuseConfidenceScore/100. Action: $block_if_malicious.status"
      }
    },
    {
      "name": "create_ticket",
      "app": "Jira",
      "action": "create_issue",
      "input": {
        "project": "SEC",
        "summary": "SSH Brute Force from $trigger.data.srcip",
        "priority": "Medium",
        "labels": ["auto-blocked", "brute-force"]
      }
    }
  ]
}

This workflow is 10 times faster than manual handling—MTTR drops from hours to minutes.

Speed Advantages of SOAR Over Manual Response

Manual processes involve detection, analysis, decision-making, and action—each step taking minutes. SOAR completes them in seconds, simultaneously enriching data from external sources (AbuseIPDB, VirusTotal). This reduces team fatigue and eliminates human errors in routine operations.

AWS Lambda's Role in Automated Response

For AWS-native automation, EventBridge + Lambda is the core. Example: GuardDuty detects a CompromisedInstance (instance communicating with a known C2 server).

Example Lambda function for GuardDuty

import boto3
import json
from datetime import datetime


def respond_to_compromised_instance(event, context):
    ec2 = boto3.client('ec2')
    sns = boto3.client('sns')

    finding = event['detail']
    instance_id = finding['resource']['instanceDetails']['instanceId']
    finding_type = finding['type']
    severity = finding['severity']

    actions_taken = []

    if severity >= 7.0:
        ec2.modify_instance_attribute(
            InstanceId=instance_id,
            Groups=['sg-isolation-group-id']
        )
        actions_taken.append(f"Isolated instance {instance_id}")

    volumes = ec2.describe_volumes(
        Filters=[{'Name': 'attachment.instance-id', 'Values': [instance_id]}]
    )

    for vol in volumes['Volumes']:
        ec2.create_snapshot(
            VolumeId=vol['VolumeId'],
            Description=f"Forensic snapshot - GuardDuty finding {finding['id']} - {datetime.utcnow().isoformat()}"
        )
        actions_taken.append(f"Snapshot created for {vol['VolumeId']}")

    sns.publish(
        TopicArn='arn:aws:sns:eu-west-1:123456789:security-incidents',
        Subject=f"[SECURITY] {finding_type} on {instance_id}",
        Message=json.dumps({
            'finding_type': finding_type,
            'severity': severity,
            'instance_id': instance_id,
            'actions_taken': actions_taken,
            'finding_id': finding['id'],
            'timestamp': datetime.utcnow().isoformat()
        }, indent=2)
    )

    return {'statusCode': 200, 'actions': actions_taken}

EventBridge rule triggers this Lambda on any GuardDuty finding with severity >= HIGH:

{ "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "severity": [{"numeric": [">=", 7.0]}]
  }
}

Handling Automation Failures

Automation handles 60–70% of typical incidents. The rest require human intervention, but with a structured playbook. This runbook lives in Git, is version-controlled, and is automatically attached to the ticket. Example playbook for privilege escalation:

## Playbook: Privilege Escalation Detected
Trigger: SIEM alert - rule 5503 (OSSEC) or T1548 (Elastic)
Step 1 - Verify (2 min)
- ausearch -k privileged -ui <uid> --start recent
- Check: is it a deploybot or real user?
Step 2 - Scope (5 min)
- who — who is currently logged in
- last -n 20 — recent sessions
- ps auxf — processes under suspicious UID
Step 3 - Contain (immediate if confirmed)
- If attacker active: pkill -u <uid>, then usermod -L <username>
- Rotate SSH keys: rm /home/<username>/.ssh/authorized_keys
- If service account compromised — rotate credentials in Vault
Step 4 - Preserve
- cp /var/log/audit/audit.log /evidence/$(date +%Y%m%d-%H%M%S)-audit.log
- ps auxf > /evidence/$(date +%Y%m%d-%H%M%S)-processes.txt

Each automated response is logged in SIEM with full context: IP address, time, finding type, actions taken. This creates an immutable audit trail necessary for compliance audits (PCI DSS, ISO 27001). The security team sees the complete incident picture even for night-time occurrences without human involvement. This reduces the burden on duty engineers and prevents context loss during shift handovers.

What Is Included in the Work

Deliverables

• Documentation: Architecture diagrams, playbook descriptions, integration guides, runbooks.
• Access: Git repository with all configurations, playbooks, and Lambda function code.
• Training: Two sessions for your team on modifying playbooks and handling exceptions.
• Support: One month of post-launch support via Slack and email.

Timeline and Estimated Cost

Cost is calculated individually after infrastructure audit. Our engineers are certified; we guarantee quality and timeline compliance. Request a consultation for your project—we'll find the optimal solution and estimate the timeline.

IBM Cost of a Data Breach Report