Real-World Automation for Rapid Incident Response
Splunk chief security evangelist Monzy Merza explores automated security operations, integrating SIEM detection with rapid orchestration workflows.
Summary
The Challenge of Alert Fatigue in Modern SOCs
Security Operations Centers face an overwhelming volume of alerts, resulting in delayed incident triage and analyst burnout.
Architecting Practical Security Automation
Monzy Merza outlines the core foundations of effective security orchestration, emphasizing reproducible workflows and structured telemetry.
Automating Containment and Threat Enrichment
Merza demonstrates automating host isolation, IP reputation lookups, and firewall rule updates in response to high-confidence SIEM detections.
Measuring the ROI of Automated Response
The author discusses Key Performance Indicators (KPIs)—including Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)—to validate automation success.
Related talks
Community Stage·26 min
Pratik Lotia · Spencer Koch
Explores Reddit's defense architecture and custom in-house resiliency engineering designed to handle massive traffic spikes and sophisticated platform abuse.
Creator Stage·27 min
Kit Louttit · Steve Winston
Breaks down executive and technical incident response perspectives following real-world cyber incidents at the Marine Exchange of Southern California.
Wild West Hackin' Fest Deadwood 2025·45 min
Henri Hambartsumyan
Investigates from Sore to SOAR: Reinventing Sentinel Automation Without Logic Apps | Henri Hambartsumyan and evaluates key implications for security practitioners.