Kernel of Truth

SOAR Automation Examples

🤖 SOAR Automation Examples

Security Orchestration, Automation, and Response (SOAR) platforms help security teams respond faster by automating routine tasks, orchestrating tools, and standardising incident handling.

This page lists realistic, high-impact SOAR playbook examples you can build using tools like:

  • Splunk SOAR (Phantom)
  • TheHive + Cortex
  • Shuffle (open source)
  • XSOAR (Palo Alto)
  • DFLabs / IBM Resilient / Swimlane

🚨 1. Phishing Email Triage

StepAction
1️⃣Parse email headers and body from suspicious message
2️⃣Extract URLs, attachments, IPs, and sender domain
3️⃣Enrich with VirusTotal, AbuseIPDB, or URLscan.io
4️⃣Check domain reputation and DKIM/SPF results
5️⃣Auto-close if known good; escalate if malicious
6️⃣Auto-quarantine email via Microsoft 365 or GMail API
7️⃣Create analyst ticket in Jira / ServiceNow

🛠 Tools: Microsoft Graph API, VT, URLscan, Cortex analyzers

🔍 2. Suspicious Login Alert (Geo-Anomaly)

StepAction
1️⃣Triggered by SIEM alert (e.g. logins from two countries within 5 mins)
2️⃣Enrich with IP geolocation, ASN, reputation
3️⃣Correlate with user activity and baseline (e.g. new device)
4️⃣Auto-prompt user via Slack/Teams for confirmation
5️⃣Suspend user or force password reset if confirmed unauthorised
6️⃣Notify SOC and update ticket status

🛠 Tools: MaxMind GeoIP, AbuseIPDB, Azure AD, Slack API

🦠 3. Malware Detected on Endpoint

StepAction
1️⃣Alert from CrowdStrike/SentinelOne/MDE
2️⃣Enrich with hash lookup in VirusTotal, ReversingLabs
3️⃣Query EDR for process tree, file origin, lateral activity
4️⃣Isolate endpoint automatically if severity is high
5️⃣Notify analyst and log in SIEM + IR tracker
6️⃣Auto-generate timeline from EDR and Sysmon logs
7️⃣Kick off playbook for evidence collection / DFIR handoff

🛠 Tools: EDR API, Cortex, VirusTotal, Splunk, SOAR platform

🌐 4. Malicious Domain Alert from Threat Feed

StepAction
1️⃣Daily IOC ingestion from threat intel source (TAXII/STIX/CSV/API)
2️⃣Parse and normalise indicators
3️⃣Match new IOC against current logs and DNS queries
4️⃣Alert if match found in the past 7 days
5️⃣Auto-add to blocklist in firewall, proxy, or DNS sinkhole
6️⃣Notify TI/IR team and attach enrichment data to case

🛠 Tools: MISP, STIX/TAXII, Sigma, Cortex, Firewall APIs

🧼 5. Credential Dumping Detection

StepAction
1️⃣Detection from Sysmon event (e.g. LSASS access) or EDR
2️⃣Query system for parent process, user context, and lateral movement
3️⃣Check against whitelist (some tools may trigger false positives)
4️⃣Isolate host and reset user credentials if malicious
5️⃣Capture memory dump, add host to high-priority watchlist
6️⃣Create case in IR system with timeline and evidence link

🛠 Tools: Sysmon, Splunk, YARA, CrowdStrike API, PowerShell scripts

📩 6. Automated Threat Intel Enrichment

StepAction
1️⃣IOC or alert triggers from SIEM
2️⃣Auto-query MISP / OpenCTI / VirusTotal
3️⃣Add metadata like malware family, threat actor, first seen
4️⃣Update detection case or dashboard with new context
5️⃣Push high-severity IOCs into blocklist or firewall ruleset
6️⃣Notify relevant teams and tag in threat feed repository

🛠 Tools: MISP, CTI APIs, SIEM, SOAR

🔁 7. Periodic IOC Sweep

StepAction
1️⃣Nightly/weekly task kicks off IOC search job
2️⃣Run Sigma/KQL/SPL queries across SIEM logs
3️⃣Check for matches in the last N days (IOC dwell time)
4️⃣Tag and escalate any positive hits
5️⃣Update case management and audit trail automatically

🛠 Tools: Splunk, Sigma, Shuffle, ElasticSearch

🧠 Summary

SOAR automation isn’t just about speed—it’s about consistency, reliability, and scale. The best use cases eliminate repetitive analyst tasks while improving incident accuracy and traceability.

⚙️ “Automate the boring. Empower the analysts.”