Automated Incident Response Pipeline (SOAR) · Hacking Project

Build an automated, playbook-driven incident-response pipeline that enriches, triages, and contains threats with auditable human-in-the-loop controls.

**The problem**
SOC analysts drown in alert volume, and manual triage introduces slow, inconsistent responses that let threats dwell. Repetitive enrichment and containment steps are error-prone and burn out staff. Most organizations cannot afford commercial SOAR or lack the engineering to build repeatable, auditable response automation.

**What you'll build**
Build a SOAR pipeline that ingests alerts from SIEM/EDR, automatically enriches them with threat intel and context, applies decision logic/playbooks, and executes containment actions (isolate host, disable account, block IP) with human-in-the-loop approval for high-impact steps. Every action is logged, measured (MTTR), and mapped to the NIST 800-61 lifecycle.

**Objective** — Build an automated, playbook-driven incident-response pipeline that enriches, triages, and contains threats with auditable human-in-the-loop controls.

**Expected outcome** — A working SOAR pipeline with alert ingestion, enrichment, playbooks, approval gates, automated containment, and MTTR metrics.

**Difficulty** — Advanced — requires multi-tool integration, playbook orchestration, safe automated containment, and audit design.

**Primary category** — SOC; Secondary = DFIR, Detection Engineering, Automation

**Security domains** — Primary = Incident Response; Secondary = Blue Team, DevSecOps, Threat Intelligence, Cloud Security

**Technical focus** — SOAR orchestration, playbook automation, alert enrichment, threat-intel integration, automated containment, human-in-the-loop approval, API integration, case management, MTTR metrics, NIST 800-61 workflow

**Core technologies** — Languages: Python; Frameworks/Libraries: Shuffle/Tines-style engine, StackStorm, n8n, Celery; Security Tools: TheHive/Cortex, MISP, Wazuh/EDR APIs, SIEM (Elastic/Splunk); Cloud/Infra: Docker/Kubernetes, message queue (RabbitMQ/Kafka), cloud provider APIs; AI/Data: alert triage scoring; Databases: PostgreSQL (cases), Redis (queue state)

**Where it's valued** — Enterprise SOCs, MSSPs, MDR providers, finance, healthcare, cloud-native companies

**Careers it builds toward** — SOAR / Security Automation Engineer, SOC Engineer, Incident Responder, Detection Engineer, DevSecOps Engineer

**Framework alignment**
• MITRE ATT&CK: responds to broad detections and drives mitigations; supports containment of Persistence (T1547), Valid Accounts (T1078), C2 (T1071); leverages ATT&CK for playbook triggering
• NIST CSF 2.0: Respond (RS.MA, RS.AN, RS.MI, RS.CO), Detect (DE.AE), Recover (RC.RP); aligns to NIST 800-61
• OWASP: N/A (relevant when responding to API/web alerts)
• CIS Controls v8: 17 Incident Response Management, 8 Audit Log Management, 13 Network Monitoring