SOC Automation Pipeline
An automation pipeline that cut mean-time-to-notify for priority alerts to under two minutes with ticketing and endpoint response.
Sanitized case study — lab / generalized evidence only
Problem
Manual triage delays response to priority alerts. Analysts needed faster notification, consistent ticketing, and a path to contain endpoints quickly.
Scope
- Alert enrichment, notification, ticketing, and containment workflow
- Orchestration layer (n8n) integrating SIEM/EDR and collaboration tools
- No internal endpoints, credentials, or private webhooks disclosed
Tools
n8nWazuh APIJIRATelegram / emailPython
Methodology
- 1Design
Map the P1/P2 alert lifecycle from detection to notification, ticket, and containment.
- 2Build
Automate enrichment, deduplication, ticket creation, and multi-channel notification with clear ownership.
- 3Response
Add guarded active-response for containment on high-confidence detections, with human-in-the-loop safeguards.
- 4Measure
Track MTTN and iterate to remove bottlenecks.
Result & Impact
- Sub-2-minute mean-time-to-notify for P1/P2 alerts
- Consistent, auto-created tickets that improved handoff and tracking
- Faster, more reliable containment on high-confidence detections
Evidence (sanitized)
- Generalized workflow diagram (detect → enrich → notify → ticket → contain)
- Before/after MTTN summary (no internal identifiers)
Lessons Learned
- Automate the repetitive, keep humans in the loop for high-impact actions.
- Reliable notification is often more valuable than clever logic.
- Measure MTTN or you cannot improve it.