2023 SOC/SOAR Solutions Forum (Video)

--- Page 1 --- How SOAR Transforms Security Operations: A Real-World Case Study Skip to main content Go to search Go to footer Log In Join - It's Free Search Search Training Learning Paths Free Resources For Organizations Back Training Courses Build cyber prowess with training from renowned experts. Ways to Train Multiple training options to best fit your schedule and preferred learning style. Cyber Ranges Hands-on training to keep you at the top of your game. Training Events & Summits Expert-led training at locations around the world. Certifications Demonstrate cybersecurity expertise with GIAC certifications. Free Training Events Upcoming workshops, webinars and local events. Workforce Security and Risk Training Harden enterprise security with end-user and role-based training. Meet Our Instructors Train with world-class cybersecurity experts who bring real-world expertise to class. Featured Course View All Courses SEC536: Adversarial AI - Penetration Testing AI Systems SEC536 Offensive Operations, Artificial Intelligence View course details Register Get a Free Hour of SANS Training Experience SANS training through course previews. Learn More Back Learning Paths By Focus Area Chart your path to job-specific training courses. New to Cyber Give your cybersecurity career the right foundation for success. By Job Role Find the courses and certifications that align with your current or desired role. Leadership Training designed to help security leaders reduce organizational risk. By Skills Framework or Directive Explore how SANS courses align with leading cybersecurity skills frameworks including NICE, ECSF and DoD 8140 Degree and Certificate Programs Gain the skills, certifications, and confidence to launch or advance your cybersecurity career. By Skills Roadmap Find the right training path based on critical skills. Featured View all Focus Areas NEW - AI Security Training Can't find what you are looking for? Let us help. Contact us Back Free Resources Watch & Listen Webinars Summit Presentations Podcasts & Live Streams Overview Read Blog Newsletters Internet Storm Center Overview Download Open Source Tools Posters & Cheat Sheets Policy Templates White Papers Overview SANS Community Benefits Connect, learn, and share with other cybersecurity professionals Customer Case Studies Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications AI Risk & Readiness Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely Join the SANS Community Become a member for instant access to our free resources. Sign Up Back For Organizations Team Development Why Partner with SANS Group Purchases Skills & Talent Assessments Private & Custom Training Programs Overview Leadership Development Management Courses & Accreditation Cyber Crisis Exercises SANS Cyber Leaders Network Overview Workforce Security & Risk Security Awareness Training Compliance Training Risk Management Services Resources Overview Public Sector Mission-focused cybersecurity training for government, defense, and education Partnerships Explore industry-specific programming and customized training solutions Sponsorship Opportunities Sponsor a SANS event or research paper Interested in developing a training plan to fit your organization’s needs? We're here to help. Contact Us Group Purchasing Log In Join - It's Free Menu Search Search Group Purchasing Blog How SOAR Transforms Security Operations: A Real-World Case Study --- Page 2 --- Previous level How SOAR Transforms Security Operations: A Real-World Case Study Jul 17 2024 Security Orchestration Automation and Response (SOAR) can be a culture shift for your operations team and possibly your entire organization. Authored by Shawn Chakravarty Share Share on X Share on linkedin Share on facebook Copy link Security Orchestration Automation and Response (SOAR) can be a culture shift for your operations team and possibly your entire organization. There are many approaches to SOAR in an operations team. Given new out of the box capabilities, some tools can shift how a security operations team function. For a long time, geeks around the world threatened, “Go away or I will replace you with a very small shell script.” I think of this attempt at humor any time an analyst on my team says the words, “Oh, I will just go automate that quickly.” And my team says it a lot. The team was told a long time ago, if you do something more than three times, it is time to automate. In early April of 2024, security researchers announced a vulnerability in the XZ project, assigned CVE-2024-3094. That morning, my threat intelligence team greeted me with multiple text messages and reports from public intelligence sources. It was a long day. The XZ utility is commonly used, and this vulnerability had a known exploit in the wild. Luckily, a Microsoft software engineer, Andres Freund, noticed a system running oddly. His discovery cascaded through my Cyber Threat Intelligence (CTI) team to my Operations (Ops) team, Vulnerability Management (VM), IT, and on down line. Not surprisingly, the teams jumped into action, but remediation would take time. While VM, IT, and other teams tested the patch and prepared to roll it out, Ops needed to hold the line. In the world of block and tackle defensive operations, there would be a lot of noise. In my role, it is important to step back and let the smart people do the work. I patiently waited for an update that seemed to never arrive. When it did, I was pleased to see that not only had signatures been built but alert validation had been automated. In the SOAR, the alerts had been validated through the vulnerability scan results. Once the SOAR determined a system vulnerability, it sent an alert and created a rule to block the traffic. It documented this rule in a ticket, elevated the ticket’s priority, and sent a Slack message to the Ops team so they could copy the new rule and apply it. This was all done in an hour. Of course, there are many ways for an Ops team to correlate the data within a security information and event management (SIEM) or a VM platform. But this was how my team decided to handle it. My team also recognized that automation was not needed for every step in the workflow. There can be both manual and automated tasks throughout the workflow. An example of this is the “report phishing” workflow. --- Page 3 --- Most of the major SOAR vendors have their salespeople swoop in with this solution first. It is low hanging fruit because analysts find responding to phishing reports tedious. It is a quick win that can result in many people hours saved immediately. The workflow is simple. Every user in the company has a button they can click to report phishing. Some of the less sophisticated phishing report buttons report the suspicious email to the Ops team. Sometimes this is done without a button. Your organization might just have a distribution list that users are told to forward the email to. Ops will review the headers, detonate links and attachments, make a determination, and respond to the user. The last step is more important than you think. But we will come back to that. If the email is determined to be malicious, a search for other such emails needs to be performed. Proxy logs need to be reviewed to see if any other workstations communicated with links or IP addresses in the email. Blocks need to be put in place. Of course, all this needs to be logged in the case management system. In a large organization, this can be tens or hundreds of emails reported daily. And each report can take upwards of an hour to fully analyze and respond. It would be easy to just say “automate the entire thing.” But in reality, it is better to approach this in smaller chunks. First, automate the receipt of the report and ticket creation. Simple enough. Now when the user clicks on “report phishing,” a ticket is created, headers are extracted, artifacts are attached to the ticket (attachments, hash, URLs etc.), and an analyst is notified of the new ticket. Now the analyst has all the data to determine whether the email is malicious. Second, automate the analysis of the artifacts. Before the ticket is created, your SOAR sends the attachments and URLs to your sandbox. The items are detonated, and the ticket is populated with the analysis. The ticket can be upgraded to a higher priority if the email is malicious. All blocks and mitigations put in place are done manually at this point. This allows the analysts to decide the efficacy of the determination and adjust. This is also when automation can be used to look for other instances of the email or communications to the known bad URLs/IP addresses. Emails can be removed from inboxes before they are ever seen by the user. Third, send the reporting user a Slack message with the determination. The importance of this step cannot be overstated. Over my many years in security the best way to ensure the “see something say something” mantra is followed is with reinforcement. Users want to know if it is a valid email. Sometimes they want to know if they CAN click on the link. When they report phishing and never hear back, they never know if it was really a malicious email. And don’t get me --- Page 4 --- started on the people that use the report phishing button instead of the delete button. In our situation, a message is sent to the user that says one of three things: “This email appears to be malicious. An analyst is reviewing it and will reach out with more information. Excellent work identifying a phishing email and protecting the company.” A similar message is sent to the user’s manager to inform them of the accomplishment. “This email has been reviewed by our automated system and appears to be benign. If you still believe it to be malicious, type yes and an analyst will review the email manually. You will receive a response from the analyst with their determination.” “Our automated systems were not able to determine if this email is malicious or benign. An analyst will manually review the email and report back to you.” This is a clear example of improving the corporate culture through continuous education and communication. You should do quarterly training with phishing assessments and communicate the results. But a simple compliment during a routine report goes a long way to reinforcing training. The last iteration of this SOAR workflow is to implement the mitigations. This is the most sensitive and can be impacting. Doing it last is critical to ensure a low false positive rate. There can still be human intervention prior to rolling out blocks or deleting emails from the mail server. There are many other low hanging fruits to grab using SOAR. Working for large enterprises, I have found that data loss prevention (DLP) alerts are a good start also. Using new Generative AI (GenAI) technologies allows us to take automation to another level when responding to DLP alerts. That’s for a future post. Ready to dive deeper into Security Orchestration Automation and Response (SOAR) and other cutting-edge security operations strategies? Enroll in or register for a demo of our LDR512 course today and gain the knowledge and skills to transform your organization's security posture. Don't miss this opportunity to become a leader in cybersecurity! Check out the LDR512 course here . Meet the expert Shawn Chakravarty Certified Instructor Shawn Chakravarty brings Upwork, AWS, PayPal, and enterprise SOC leadership experience to SANS security management training, helping students connect frameworks, risk, cloud security, incident response, and leadership decisions. Read more about Shawn Chakravarty Get Curated News, Vulnerabilities, and Essential Security Awareness Tips Subscribe to Newsletter The Highest Standard in Cybersecurity Education Since 1989 Company About Instructors Careers Press Help & Support Contact FAQs Legal Training Programs Work Study Program Academies & Programs Workforce Development Partnerships Law Enforcement SkillsFuture Singapore Cybersecurity Degrees & Certificates Get Involved Become a SANS Member Become an Instructor Become a Sponsor Speak at a Summit Award Programs Join the Cyber Leaders Network Privacy Policy Terms and Conditions Do Not Sell/Share My Personal Information Cookie Notice © 2026 The Escal Institute of Advanced Technologies, Inc. d/b/a SANS Institute. Our Terms and Conditions detail our trademark and copyright rights. Any unauthorized use is --- Page 5 --- expressly prohibited.