Python for Security Orchestration Automation and Response (Merlin Corey)
Presenters detail vulnerability discovery and exploitation in Python for Security Orchestration Automation and Response (Merlin Corey).
Summary
SOAR Value Proposition
Merlin Corey (presenting as “Merlin the wizard”) argues security orchestration, automation, and response (SOAR) speeds and stabilizes incident handling. Analysts waste time on repetitive manual steps; targeted automation—often born from frustration—returns capacity to higher-order work.
Why Python
Python’s batteries-included stdlib (HTTP, crypto) plus ecosystem (requests, BeautifulSoup, pandas, boto3 API wrappers) makes it ideal glue for pulling data across SIEM, ticketing, cloud, and email systems—even when only base Python is allowed.
Processes, Tasks, and Workflows
Incident response is the business process; analysis is a task; log collection, normalization, filtering, and review form repeatable workflows. SOAR platforms range from narrow (e.g., phishing-focused tools) to broad orchestrators (e.g., Palo Alto XSOAR/Cortex XSOAR) that integrate specialized products.
Platform Landscape and Cautions
Automation must be validated with analysts, costed against manual effort, and guarded against runaway jobs—Merlin cites 3,000 tickets spawned in one day from a bad signal. Hyperautomation extends cross-business AI-assisted automation generation, but SOAR plus Python skills remain the practical starting point for security teams.
Related talks
RSAC Cybersecurity·45 min
Presenters detail vulnerability discovery and exploitation in Doing Security Orchestration, Automation and Response before It Was Born.
BSides Lisbon·32 min
Nicolas Mattiocco
Nicolas Mattiocco examines 2018: SecOps Automation And Orchestration.
Hack In The Box Security Conference·21 min
Nicolas Mattiocco
Nicolas Mattiocco investigates #HITBHaxpo D2 - PatrOwl - The Red Flavour Of SOC Automation And Orchestration.